Venice Commission - Report on a rule of law and human rights compliant regulation of spyware

Disclaimer: this information was gathered by the Secretariat of the Venice Commission on the basis of contributions by the members of the Venice Commission, and complemented with information available from various open sources (academic articles, legal blogs, official information web-sites etc.).

Every effort was made to provide accurate and up-to-date information. For further details please visit our site : https://www.venice.coe.int/

San Marino

1. Does your legal framework allow for the use of spyware as a tool of targeted surveillance either in criminal or intelligence investigations or is there an explicit prohibition on the use of spyware? If so, how does your domestic legal framework define spyware?

San Marino legal system regulates the investigative instrument of interceptions by means of Law no. 98 of 21 July 2009 (“Law on Interceptions”), followed by Delegated Decree no. 178 of 29 December 2009 on the confidential archive referred to in Article 13, paragraph 2 of the same Law and by Regulation no. 4 of 10 June 2014 on the technical procedures for carrying out interceptions. In addition to regulating application and legitimacy conditions, these provisions also envisage a specific procedure for the adoption of the interception measure in criminal proceedings, which is entrusted to the Investigating Judge and the Judge responsible for Interceptions, as well as several moments of cross-examination to ensure the usual acquisition of evidence in the proceedings. The key moments of the taking and preservation of evidence, as well as of its use, are also regulated.
However, the legislation does not provide for an explicit definition of Spyware (understood as software capable of remotely hacking an electronic device to capture its communications and contents). Indeed, Law no. 98 identifies the instrument of interception in a broad and general sense, including in this definition all “interceptions of communications that may be related to the suspected person by means of secret listening”, carried out with the aid of appropriate tools. It follows that the legal framework also applies to spyware to the extent that it is compatible.
It should be pointed out that, in practice, the number of investigations carried out by the Court of the Republic of San Marino is limited, also due to the small size of its territory and population (typical of a Microstate). Interceptions of communications have been carried out only in a few cases, while spyware has never been used.
Moreover, again due to the small size of the Republic of San Marino, the investigative measure in question, if it is intended to intercept foreign telephone users (which is almost always the case), can be implemented by the Judge of the Court of San Marino only following a specific judicial request (“Outgoing Rogatory Letters”) addressed to the Judicial Authority of the country of reference, which slows down the investigative procedures.

2. Are there specific rules (covering notably the scope ratione materiae, temporis and personae) in place or do the general rules on targeted surveillance (interception of communications) apply (could you please provide us with such specific or general rules)?

There is a lack of both a definition of spyware and a specific discipline dedicated
to its use in the investigative field. Therefore, the broader and more general provisions on interceptions laid down in Law no. 98 of 21 July 2009, referred to above, apply mutatis mutandis. On the other hand, the absence of any concrete case prevents further useful information from being provided.

3. What kind of data, if any, could be collected with spyware?

As there is no specific definition, no specific discipline dedicated to the use of spyware and no concrete case history in the judicial field, further information is not available to answer this question.

4. Has there been any official evaluation of the need for, or added value of, spyware?

To date, no official assessment has been made specifically for spyware, taking into account both the small number of judicial cases (due to which spyware has not yet been used in investigative activities) and the already existing (and extensive) legislation on interceptions, which can generally include the various forms of interception of communications related to the suspected person.

5.Who authorises/approves measures of targeted surveillance in criminal and intelligence investigations (judiciary, executive, expert bodies, security services)?

Law no. 98 of 21 July 2009 governing the interception instrument authorises its use in investigative matters only by the Judicial Authority that orders it. The actual execution of interceptions is entrusted to the Judicial Police designated by the Judge.

6. What are the national oversight mechanisms in place in your country for the activities of the security services (are they judicial, parliamentary, executive, or expert)? Do these bodies have (binding) remedial powers?

The Republic of San Marino does not have a national Secret Service established by law. There are only bodies that perform military or police functions.
Only the Judicial Authority may order interceptions during investigative activities. Therefore, the control mechanisms in place are those expressly provided for by procedural law.
It should be recalled that Law no. 98 of 21 July 2009 provides, in addition to the Investigating Judge, for the presence of another Judge responsible for Interceptions with the function of authorising and controlling interception operations, as well as for several moments of cross-examination with the defence lawyers of the suspected person in order to ensure the usual acquisition of evidence in the proceedings.
The Judge responsible for Interceptions exercises formal and substantive control over the use and acquisition of evidence from interceptions and has the power to take several important measures: can extend the time-limit for interceptions; validates the investigative act of the individual interception (in case of refusal, the interception cannot be carried out); controls the confidential register of interceptions6 where all measures pertaining to the individual investigative act are recorded for each interception, and gives binding consent to the destruction of interceptions if they are not relevant to the investigation; authorises the
defendant’s lawyers to take copies of the documents related to interceptions for the full exercise of the rights of defence; orders the acquisition of interceptions relevant to the proceedings, the use of which is not prohibited; orders an expert report on the transcription of the recordings or the printing or reproduction, in the clearest and most comprehensible form possible, of the information contained in the computerised or telematic communication streams obtained, if necessary for the purposes of understanding; may request direct access to recordings and computer media; may, at any stage and level of the proceedings, order that all documents related to interceptions be destroyed, unless they constitute the corpus delictiand gives binding consent if the request for destruction comes from the Investigating Judge who ordered the interception.

7. Does a post-surveillance notification mechanism exist? Are there any other remedies available for individual targeted by measures of targeted surveillance?

Law no. 98 of 21 July 2009 governing interceptions provides for several control mechanisms following the authorisation of interceptions by the Investigating Judge.
These control mechanisms are implemented both through the intervention of the Judge responsible for Interceptions (see answer to question 6), who exercises wide and multiple binding powers with regard to the examination and acquisition of intercepted communications, and through the direct involvement of the suspected persons and their defence lawyers with regard to many of the tasks related to the taking of evidence from interceptions in criminal proceedings.
Once the Investigating Judge who ordered the interception has filed with the Registry the minutes and recordings of the relevant interceptions, the parties’ defence lawyers are entitled to examine the documents and listen to the recordings, as well as to resort to their trusted technical experts in the exercise of these rights. They may then request the acquisition of other communications or highlight conversations that are deemed irrelevant or the use of which is prohibited. Defence lawyers are also heard before the Judge responsible for Interceptions orders the acquisition of the conversations relevant to the criminal proceedings.