They Searched My Phone or Cloud Without Authorisation: Is the Evidence Excluded?

In cases with digital evidence —computer fraud, hacking, disclosure of secrets, money laundering or any cybercrime— the case is often won or lost on a preliminary question: how the evidence was obtained. Access to an investigated person's phone, computer or cloud is subject to strict safeguards, and breaching them can lead to the exclusion of the evidence and of everything derived from it.

Searching a device requires a specific judicial authorisation

Since the 2015 reform of the Criminal Procedure Act, Arts. 588 sexies a) to c) LECrim govern access to the content of mass data storage devices. The essential rule is that authorisation to search a home does not automatically allow access to the phone or computer: a specific, reasoned and proportionate judicial decision is required, defining the scope of access. Art. 588 sexies c) extends that requirement to access to information stored in the cloud reached from the device.

Consent without safeguards is debatable

It is common for police to access the phone with the investigated person's 'consent'. But that consent is only valid if it is free, informed and given with safeguards. For a detainee, case law is especially demanding: consent obtained without clear information about its consequences or without legal assistance may be declared ineffective, leaving the search without legal cover.

Evidence exclusion (Art. 11.1 LOPJ)

Where access is obtained without valid authorisation, Art. 11.1 LOPJ comes into play: evidence obtained, directly or indirectly, in breach of fundamental rights has no effect. The exclusion may extend to derived evidence through the connection of unlawfulness, so that excluding an unlawful phone extraction can leave much of the prosecution case without support. This is why analysing the chain by which the evidence was obtained is one of the defence's first tasks.

IP, traffic data and attribution of authorship

A second front is the attribution of authorship. An IP address identifies a connection, not a person: shared WiFi networks, NAT/CGNAT, VPNs or simple use of the device by a third party break the link between IP and author. Moreover, disclosure of the traffic data retained by the operator requires judicial authorisation (Art. 588 ter LECrim). The defence can challenge both the lawfulness of obtaining that data and its real ability to identify a specific person.

Chain of custody of the electronic evidence

Finally, digital evidence is fragile and easily altered. The chain of custody —how the digital content was seized, cloned, hash-sealed and brought into the proceedings— must be documented. Gaps in that process, the absence of a forensic clone with integrity verification or the inability to rule out alterations all allow the reliability of the expert evidence to be challenged.

Defence with digital evidence at Alonso Sala

At Alonso Sala, a criminal-defence firm in Madrid (C/ Velázquez 27) with coverage throughout Spain, we analyse the lawfulness of device searches and the strength of digital evidence in each case, working with computer experts. Read more on our hacking and intrusion and cybercrime pages.