LAWFUL HACKING – TECHNICAL ISSUES IN LAW

Abstract

Purpose

Since legislators in several countries have introduced in recent years necessary amendments in criminal procedure rules, the purpose of the paper is to consider regulatory framework for lawful hacking as a new digital investigative measure, i.e. the power of LEA to secretly and remotely access computer device or network in order to gather digital evidence.

Design/Methods/Approach

Because police hacking powers vary considerably by jurisdiction, with various functionalities and scopes, but also with the way the law regulated important technical issues, the author analyzes normative framework, using comparative legal method. Based on the legislative provisions, the author discusses how technical means and techniques used by law enforcement agencies are represented in the legislation.

Findings

The integrity of the digital evidence, extracted from the target’s device/network after hacking, may be maintained only if several technical issues are properly addressed in law: which exploits are to be used as necessary and preferable, should LEA be obliged to disclose vulnerabilities; should LEA purchase or develop in-house hacking tools; in which manner the hacking tools need to be secured, and in line with which state-of-the-art guidelines; should automatized hacking operations, such as drive-by-downloads or water-holing, be allowed, etc.

Originality/Value

After using comparative and normative method, the author suggests policies by which any potential damage for data security and privacy could be limited, when regulating and enforcing norms for lawful hacking.  In this sense the author gives concrete de lege ferenda proposals.