The Computer Crime III Act (Wet Computercriminaliteit III) gives Dutch investigating authorities far-reaching powers to access phones, computers and other devices in criminal investigations, including a covert “police hacking” power for serious offences. The Dutch Senate passed the Act on 26 June 2018 and its provisions entered into force in stages during 2018 and 2019, so the powers described below are now part of everyday criminal investigation practice in the Netherlands.

For businesses and individuals, the practical significance lies less in the new offences the Act created than in the investigative powers it grants: data on a company system can be reached in an investigation directed at someone else within the organisation, and a device can be entered without the user ever noticing.

Why does this remind people of the Snowden case?

Far-reaching digital investigative powers are not unique to the Netherlands. The best-known example is the United States, where whistleblower Edward Snowden revealed the NSA’s large-scale PRISM interception programme, which for years operated largely without prior, case-by-case judicial authorisation. The story is widely known through Anatoly Kucherena’s book on Snowden’s case and the film it inspired. The comparison is not exact: the Dutch legislature built in additional safeguards, discussed below, specifically to avoid a similarly unchecked use of these powers. Whether those safeguards go far enough remains the central point of debate around the Act.

What powers does the Act give investigating officers?

The explanatory memorandum to the bill set out five purposes for which the new powers may be used:

Identifying the device or its user: officers may secretly access a computer, router or phone to obtain details such as an IP address or IMEI number.
Recording stored data: officers may record data needed to establish the truth in a serious crime, for example login details for closed online communities or stored images relevant to the investigation.
Making data inaccessible: data used to commit a crime can be made inaccessible to end it or prevent further crimes, for example to disable a botnet that is actively being used to attack other systems.
Intercepting confidential communications: communications can be intercepted and recorded, with or without the cooperation of the service provider that carries them.
Systematic observation: officers may track a suspect’s location and movements over time, including by remotely installing software on the device itself.

Taken together, these powers let officers do more than search a device once: they allow ongoing, largely invisible monitoring of a suspect’s digital life for as long as the authorisation lasts.

Which offences can trigger these powers?

The powers are not limited to cybercrime, and that is one of the most misunderstood aspects of the Act. The power to identify a device or user, and the powers to intercept communications and carry out systematic observation, may be used for any offence for which pre-trial detention is permitted, which generally means an offence carrying a minimum sentence of four years. Recording stored data and making data inaccessible require a heavier minimum sentence of eight years, unless a specific crime is designated by order in council because ending it is of clear public importance, such as certain forms of large-scale fraud or the distribution of child sexual abuse material. A device may only be entered covertly while the suspect is actually using it at that moment.

What safeguards apply before these powers can be used?

Only a public prosecutor can request the use of these powers, and every request needs prior authorisation from an investigating judge (rechter-commissaris) before it is carried out. For the hacking power in particular, the Public Prosecution Service’s Centrale Toetsingscommissie also assesses the intended use in advance. Beyond the sentence thresholds described above, every application of these powers must still meet the general requirements of proportionality and subsidiarity that apply throughout Dutch criminal procedure: the intrusion must be justified by the seriousness of the case, and there must be no less invasive way to achieve the same investigative result.

What else changed under the Act?

Two further changes attracted less attention than the hacking power itself, but affect a wider group of people in practice. First, investigating officers may now use a decoy profile presenting as a minor to trace so-called groomers who search for sexual contact with children online. Second, it has become easier to prosecute people who knowingly receive stolen data, as well as online sellers who take payment for goods or services but never deliver them.

What are the main objections to the Act?

The scope of the Act is broad, and the four-year sentence threshold does not by itself guarantee that only the most serious offences are involved: several עבירות פליליות that most people would not think of as especially grave already carry that sentence or higher. A suspect who ultimately turns out to be innocent will still have had their own data closely examined, and often the data of family, friends, employers and others they were in contact with as well, since a phone or computer is by nature used to reach many other people. Critics have also questioned whether everyone involved in approving and supervising requests has the specialised technical knowledge needed to assess a hacking request properly, given how quickly the underlying technology develops. At the same time, the powers respond to a real and recognisable problem: online fraud and scams are common, and no parent wants their child to come into יצירת קשר with an inappropriate individual online. Whether the Act strikes the right balance between investigative power and privacy remains a matter of ongoing debate among lawyers, politicians and civil society organisations.

מה המשמעות של זה עבור העסק שלך?

If your organisation stores communications, logs or other data on its own systems, that data can in principle be reached under these powers even if the investigation targets an employee, a customer or a third party rather than the company itself. This is different from a regular request for information, where a request can usually be reviewed and, if needed, challenged before anything is handed over: the powers under this Act are designed to be used covertly, so the first sign of an investigation may only appear once it is already concluded, or not at all.

It is therefore worth knowing, before any request or order reaches your organisation, who within the business is authorised to receive it, what records are kept of any assistance given to investigating officers, and how to verify afterwards that the legal requirements described above were actually met. Employers should also be aware that a hacking power exercised against one employee’s device can, in practice, expose the communications and data of colleagues who exchanged messages with that person and had nothing to do with the investigation themselves.

לסיכום

The Computer Crime III Act gives Dutch investigating officers covert hacking, data-recording, data-blocking, interception and systematic observation powers.
The Senate passed the Act in June 2018 and it entered into force in stages during 2018 and 2019 – it is current law, not a pending proposal.
Most powers require a minimum statutory sentence of four or eight years, plus prior authorisation from an investigating judge.
Data belonging to a company, or to an uninvolved third party, can be reached in an investigation aimed at someone else.
The main criticism is the breadth of the powers and the risk that the data of innocent parties is examined along the way.

שאלות נפוצות

Can the police hack any device they want? No. The device must belong to or be used by a suspect in an investigation into an offence that meets the relevant sentence threshold, and a prosecutor and an investigating judge must authorise the request in advance.

Can my company be affected even if it is not under investigation? Yes. If data relevant to an investigation into someone else, such as an employee or customer, sits on your systems, that data can potentially be reached.

Is this the same as the NSA’s PRISM programme? No. The Dutch Act requires case-by-case prior judicial authorisation and sentence thresholds that were not part of PRISM as it operated for years in the United States, though critics argue the Dutch safeguards should go further still.

לא בטוחים מה מצבכם? ספרו לנו על מצבכם. נודיע לכם על האפשרויות העומדות בפניכם תוך יום עסקים אחד.

איך Law & More יכול לעזור לך עם זה מוסבר אצלנו עורך דין פלילי .