The development of technology has changed the way we communicate and with it the way criminal offences are proven. Communication through encrypted applications, electronic traces, photographs, metadata and digital content in general are today an integral part of every more complex criminal proceeding. The current focus is on data obtained through the SKY ECC application, which in recent years has become one of the most frequently used forms of evidence in organized crime cases.
Few pieces of evidence have provoked as much professional and public controversy. While public debate is largely reduced to the question of whether SKY evidence is lawful or not, court practice shows that this is a far more complex problem. Behind a seemingly simple question lies a whole series of procedural dilemmas that cannot be resolved with a single answer. That’s why it’s important to separate several matters that are often unfairly merged in public discussion. There is the question of the lawfulness of obtaining evidence, the question of its admissibility in criminal proceedings, the question of its evidentiary value, and the question of whether the standard of proof required for a conviction has been met. Each of these questions is governed by its own rules and requires a separate answer. One cannot automatically be derived from another. When these categories are mixed together, conclusions emerge that may sound convincing in public debate but have no real basis in procedural law.
Under the label “SKY evidence,” practice in fact covers different types of data and different stages of their processing. Original digital data, communication, identification files, translations, police analyses and expert opinions. All of this is often treated as a single unit, even though it involves evidence of different procedural nature and different evidentiary weight. For that reason it’s not enough to establish that a particular message exists. It’s also necessary to establish its origin, authenticity, integrity, the way it was extracted from the overall body of data, the way it is connected to a specific person, and finally what it actually proves.
European case law offers no simple answers to these questions. French courts rule on the lawfulness of the conduct of French authorities. The Court of Justice of the European Union examines the rules on the international exchange of evidence between states. The European Court of Human Rights examines whether the proceedings as a whole were fair. None of them, however, decides in place of the domestic court whether the standard of proof has been met in a particular case, or whether the evidence presented excludes reasonable doubt. The development of technology may change the way evidence comes into being, but it must not change the procedural standards on which a fair trial rests.
What Was SKY ECC and How Was It Breached
It’s useful first to explain what SKY ECC actually was and how French authorities came into possession of the communications now used as evidence. Without that technical context, it’s hard to understand why the question of the lawfulness of obtaining the data arises at all.
SKY ECC was not an application like WhatsApp, installed on an ordinary phone. It was a closed communication network that operated exclusively on specially modified devices, most often Google Pixel, BlackBerry or iPhone handsets running a custom operating system. Messages were end to end encrypted, and the servers on which the communication ran were located in France and Canada. For many years, police authorities were unable to read its content. It’s often, incorrectly, claimed that the French gendarmerie “broke” SKY ECC’s encryption. That is not true, and the difference is not merely terminological. The encryption itself was not broken. French authorities, with the help of Dutch police and Europol, managed to compromise the SKY ECC network’s infrastructure itself. In other words, no already locked, encrypted message was read. Instead, software was inserted into the system that intercepted content before a message was encrypted, or immediately after it was decrypted on the recipient’s device. It’s the same principle as reading the content before it’s locked in a safe, rather than trying to open a safe that is already locked. At that point the encryption stops being relevant, because the content is accessed at the moment it temporarily exists in readable form.
This was an operation prepared over years. It involved a long investigation of the infrastructure, obtaining judicial authorization in France, developing dedicated software, testing it, and finally covertly implanting it in the servers. The mere collection of communications, once the infrastructure was compromised, lasted several months, during which several tens of millions of messages were intercepted. According to publicly available data, over 70,000 users used the network during that period, and the total volume of data collected, including messages, photographs, PINs and contacts, exceeded a billion items.
The operation was not, contrary to what is often heard, authorized by Europol, since Europol has no power to order covert surveillance measures. Its role is coordinating and analytical. The order was issued by the French judiciary, since the SKY ECC network’s servers were located on French territory, which is why French courts had jurisdiction to authorize the measure. Dutch police took part in the operation because a significant part of the platform’s technical infrastructure was linked to the Netherlands.
From Mass Interception to Montenegrin Cases
It’s important to clarify one circumstance that is often misrepresented in public. French and Dutch authorities did not target alleged members of Montenegrin criminal groups. No one, at the interception stage, chose to follow specific individuals from Montenegro. Rather, the entire communication of all SKY ECC users was intercepted, and only afterward did the analysis of the collected material begin. Everything was collected first, in other words, and filtering followed later. That filtering is a classic example of intelligence analysis. French analysts did not manually read tens of millions of messages, since that would have been practically unfeasible or would have taken years. Instead, they used a combination of indicators: nicknames, phone numbers, device IMEIs, SKY identifiers, GPS locations, photo content, contacts, existing police databases, prior investigations and automated search and linking algorithms. If, for example, a user wrote “See you in Budva,” “Say hi to Igor,” or “Send the goods to Bar,” the system would automatically flag such communication as potentially relevant to Montenegro, after which analysts would review it further.
French authorities did not conclude that particular communication potentially belonged to the Montenegrin criminal world on the basis of a single indicator, but on the basis of a set of mutually reinforcing indicia. The use of base stations in Podgorica and Montenegro, photographs of vehicles with Montenegrin plates, communication in the Montenegrin language, references to individuals already known to police, or communication predominantly with other accounts already linked to Montenegro. For that stage, French authorities did not need to know the exact identity of the user. It was enough that a sufficiently strong connection to Montenegro existed for the material to be forwarded to Montenegrin authorities.
The transfer of the material itself took place through a chain of international cooperation, from French authorities, through Eurojust and Europol, to the Special State Prosecutor’s Office of Montenegro (SDT) and the police. Montenegro did not receive the complete database of intercepted data, but rather material related to Montenegrin investigations or persons of interest, in certain cases including so called raw data, together with the accompanying technical records.
Three Legal Questions
Most of today’s debates about evidence obtained through SKY ECC start from the seemingly simple question of the lawfulness of that evidence. That question, however, has no simple answer. Not because the legal situation is unclear, but because the term “lawfulness of SKY evidence” in reality conceals at least three entirely different legal questions. Treating them as one is a principal reason why the public, and even more often legal professionals, arrive at mistaken conclusions.
a) The lawfulness of obtaining the data
This question concerns primarily the state, or states, in which the data collection operation was carried out. Interception of SKY ECC communication was carried out in March 2021, as part of a joint operation by French, Belgian and Dutch judicial and police authorities, coordinated through Eurojust and Europol. Unlike the EncroChat case, which was predominantly a French project with Dutch technical support, Belgium had an independent investigative role in the SKY ECC case, so depending on the specific case, questions may arise not only under French but also Belgian law. Most of the technical operation was nonetheless carried out by the French gendarmerie.
Specifically, this is the measure set out in Article 706-102-1 of the French Code of Criminal Procedure (captation de données informatiques), a technique consisting of infiltrating IT equipment in order to intercept data before it’s encrypted, as distinct from classic interception of communication channels. Under Article 706-95-12 of the Code, this measure is authorized by the liberty and custody judge (juge des libertés et de la détention), at the request of the public prosecutor, during the police inquiry (enquête), or by the investigating judge, following the prosecutor’s opinion, during the judicial investigation (information judiciaire). The constitutionality of using means protected by national defense secrecy in this context was confirmed by the Constitutional Council, the French counterpart to Montenegro’s Constitutional Court, in decision no. 2022-987 QPC of 8 April 2022, issued on a challenge to the constitutionality of Articles 230-1 to 230-5 and 706-102-1 of the Code. Whether there was a legal basis for applying this measure, whether it was authorized by the competent authority, whether it was carried out within the scope of the authorization granted, and whether all conditions prescribed by French law were met, are questions that French courts primarily answer.
b) The international transfer of the collected data
Even accepting that the data was lawfully obtained in France, the question remains under what conditions it may be transmitted to other states and used in their criminal proceedings. Two entirely different situations need to be distinguished here.
For European Union member states, this question is governed by the rules on the European Investigation Order (Directive 2014/41/EU), which allows evidence obtained in one member state to be used in proceedings conducted in another. Montenegro, although close to accession, is not yet an EU member state, so the rules on the European Investigation Order should not apply to it directly. The transfer of data between Montenegro and France is governed by the classic instruments of mutual legal assistance in criminal matters, primarily the European Convention on Mutual Assistance in Criminal Matters of 1959 with its additional protocols, as well as bilateral agreements with France. Since 2018, Montenegro has also had a special Law on Judicial Cooperation in Criminal Matters with EU Member States, which governs cooperation specifically with states such as France, partially adopting instruments of EU law. This distinction is not a formality. The standard applied to the transfer of data, as well as the burden of proving that the transfer was lawful, depend on which legal instrument was applied in the particular case.
An additional layer of complexity is added by the way the data was actually forwarded in practice. Part of the SKY ECC material was delivered to other states on the basis of a formal request for legal assistance, while part was delivered spontaneously, on the initiative of French authorities, without a prior individual request from the receiving state. It was precisely this spontaneous transmission that was the subject of dispute in a number of domestic proceedings, since the question arose whether such a method of transfer, in itself, constitutes a sufficient legal basis for using the data, especially where the receiving state is not an EU member. The European Court of Human Rights addressed the question of an obligation to first apply to French courts in the case of A.L. and E.J. v. France (applications nos. 44715/20 and 47930/21, decision of 24 September 2024), which concerned EncroChat data transmitted to British authorities. The Court declared the applications inadmissible for failure to exhaust domestic remedies before French courts, thereby indirectly confirming that assessing the lawfulness of the French measure falls primarily within the jurisdiction of French courts. The same principle, by analogy, applies to SKY ECC cases. This means that this question does not concern the lawfulness of the data collection operation itself, but exclusively the lawfulness of its international transfer and use in another state.
c) The evidentiary value of the data
Even if all of the above is accepted, that the data was lawfully obtained and lawfully delivered to domestic authorities, this does not resolve the question of its evidentiary strength. The court must still establish whether the user of particular communication has been correctly identified, whether the data is authentic and complete, whether its integrity has been preserved, whether the defense has been given an effective opportunity to challenge it, and whether the evidence presented, taken as a whole, excludes any reasonable doubt regarding the facts constituting the elements of the specific offence.
Different procedural concepts are most often conflated at this point, and it’s worth distinguishing them clearly. The lawfulness of evidence (whether it was obtained in accordance with procedural law) is not the same as its admissibility in domestic proceedings (whether the evidence may be introduced and used in proceedings at all, regardless of how it came into being). Admissibility of evidence, in turn, is not the same as its evidentiary value (how much weight and persuasiveness the evidence carries in relation to the disputed fact). Evidentiary value, finally, is not the same as whether the standard of proof required for a conviction has been met (whether the totality of the evidence presented excludes any reasonable doubt). In other words, the fact that a piece of evidence was obtained in accordance with the law of the state in which it originated does not automatically mean it’s sufficient for a conviction in another state. Equally, objections regarding the manner in which evidence was obtained do not, by themselves, answer the question of what that evidence actually proves in the specific case.
The European and Domestic Legal Framework
The question of the use of communication conducted through the SKY ECC application, obtained when police authorities accessed the application’s servers, has moved beyond the boundaries of national legal systems, given the manner in which the data was obtained and later delivered to the judicial authorities of several states. French courts, the Court of Justice of the European Union and the European Court of Human Rights have ruled on particular aspects of its use, and domestic courts have, in practice, for the most part simply adopted their positions, without any broader analysis or scrutiny of their own, which today forms a significant part of Montenegrin case law. Uncritical acceptance of evidence delivered through mutual legal assistance, without verifying its own origin and the procedural guarantees that accompanied it, is not an expression of trust in international cooperation, but a quiet abdication of judicial sovereignty, submissiveness disguised as efficiency. That danger becomes more real when the decision to accept evidence without deeper analysis is driven not by legal conviction but by a wish to be remembered as the first to hand down a particular ruling, regardless of the price such a decision carries for the consistency of case law and the rights of the defense.
Although these decisions are often cited as arguments for or against using SKY communication as evidence, it should be kept in mind that they did not rule on the same legal questions. French courts primarily examined the lawfulness of the conduct of French investigative authorities and the application of provisions of the French Code de procédure pénale governing special investigative measures and the obtaining of digital data. Their rulings concern the lawfulness of proceedings conducted before French authorities and the procedural guarantees prescribed by French law. The Court of Justice of the European Union approached the matter from an entirely different perspective. Its analysis was not directed at assessing the lawfulness of the French operation, but at the rules governing the international exchange of already obtained data between EU member states, that is, at interpreting the rules governing the European Investigation Order and the mutual recognition of evidence in cross-border criminal proceedings. Nor did the European Court of Human Rights rule on whether SKY communication is, in itself, lawful or unlawful evidence. Its role was to examine whether the conditions for bringing a case before it were met in the specific proceedings, that is, whether domestic remedies had been exhausted and whether the proceedings, viewed as a whole, met the standards of a fair trial prescribed by the European Convention on Human Rights. Domestic courts, finally, faced a different task from all of the European courts mentioned. Their duty was not to assess the lawfulness of the work of French judicial authorities nor to interpret EU law, but to answer the question of the conditions under which communication obtained through mutual legal assistance may be used as evidence in criminal proceedings before Montenegrin courts.
This overview of jurisdiction alone shows that European and domestic practice do not form a single, unified body, but a system of decisions answering different procedural questions. For that reason, individual decisions cannot be viewed in isolation, nor can conclusions be drawn from them that go beyond the case the particular court was deciding.
What Is Digital Evidence?
In discussions of SKY cases, the term “SKY evidence” is often used as though it referred to a single, unified piece of evidence whose nature is clear to everyone. In reality, no such single piece of evidence exists. What is referred to in court proceedings as “SKY communication” is in fact a body of different digital data that has passed through several stages of collection, processing and procedural transformation before reaching the court. It is therefore not possible to speak of a single piece of evidence, but rather of a series of interconnected digital traces of different procedural nature.
At the beginning of this process are the original data collected by French judicial authorities, delivered, in bulk and generally unprocessed form, to the competent authorities of the state conducting the criminal proceedings. As a rule, that data is not itself the direct subject of the evidence presented before domestic courts. Before becoming part of the case file, it passes through several stages of extraction, systematization and processing carried out by domestic police and judicial authorities. From the enormous volume of communication, messages considered relevant to a particular case are extracted, linked to specific user PINs, translated and analyzed. Already at this stage an important procedural question arises. What exactly is the evidence the court is presented with? Is it the original digital record, an extracted portion of the communication, an identification file, a translation of the communication, or a police analysis? None of these questions should be answered only in theory, since different elements of digital material have a different procedural nature and cannot carry the same evidentiary weight.
The fact that a particular message exists is, for example, one evidentiary fact. The conclusion that a specific accused was the author of that message is an entirely separate question. Likewise, the fact that a particular photograph appears in the communication is not the same as the conclusion that the photograph depicts narcotics, a firearm, or the object of a crime. The former is a fact that can be directly established, while the latter is a conclusion that must be drawn on the basis of other evidence or expert knowledge. The same applies to identification files. They are not original digital data, but the result of an analysis linking specific digital traces to particular individuals or events. Such an analysis may be entirely correct and professionally sound, but for that very reason it must remain subject to judicial scrutiny. A court cannot uncritically accept a conclusion merely because it was reached using complex technical methods. Digital evidence differs from most traditional evidence precisely in that the court usually does not have the original item itself, but rather its digital reproduction, or a portion of a much larger body of data. That is why questions of authenticity, integrity, completeness and origin of digital content take on particular importance. The more complex the path evidence travels from its creation to the courtroom, the greater the need for every stage of that path to be procedurally verifiable.
This, of course, does not mean digital evidence is less reliable than traditional evidence. On the contrary, it often represents an extremely valuable evidentiary tool. Its evidentiary strength, however, does not derive from the mere fact that it’s digital, but from the court’s ability to verify its origin, authenticity, integrity, and the way it connects to the legally relevant facts in the specific proceedings. In cases based on digital communication, judicial analysis therefore cannot end with establishing that a particular message or photograph exists. Only then does a far more complex question arise. What legally relevant fact does that digital content actually confirm or refute?
The Evidentiary Value of Digital Communication
Once it’s established that particular digital communication is admissible evidence in criminal proceedings, a question of fundamental importance to every evidentiary process arises. What does it actually prove? The answer is not always simple. The fact that particular communication exists is evidence that content was exchanged between certain user accounts and presented to the court. This does not automatically give evidentiary value to the facts referred to within that communication. As with any other evidence, the existence of the evidence must be distinguished from the facts one seeks to establish through it. This is particularly important in cases where such communication represents the predominant or decisive evidence.
The fact that two people exchange messages about narcotics does not, for instance, mean by itself that narcotics existed, were in their possession, or were actually trafficked. Likewise, communication about acquiring a firearm does not automatically prove that the weapon was obtained, or that it was used to commit the specific offence. A conversation about a particular event is not necessarily proof that the event actually took place. This does not mean such communication has no evidentiary value. On the contrary, it can represent an extremely strong evidentiary basis. Its evidentiary strength, however, depends on the content of the particular communication, its connection to other evidence, and the overall factual context in which it is assessed. That is why, in certain cases, the existence of independent confirmation of the content of digital communication becomes especially significant. Such confirmation can take various forms, such as material traces, results of searches, items found, financial documentation, biological traces, video surveillance, witness testimony or other circumstances confirming the claims contained in the communication. Whether or not such confirmation exists is not a question of admissibility of evidence, but of its persuasiveness.
The question of photographs forming part of digital communication is particularly contentious. A photograph is evidence that a particular digital record came into existence, but it does not by itself necessarily prove the fact it purportedly depicts. Similar questions arise in connection with identifying the user of digital communication. The fact that particular content exists is not the same as the fact that a specific person created it. Between these two conclusions lies an entire series of evidentiary questions the court must consider before establishing the identity of a party to the communication.
The European Court of Human Rights does not prescribe what type of evidence must exist for a conviction to be handed down, nor does it require a specific number of mutually corroborating pieces of evidence. Its case law starts from the fairness of the proceedings as a whole and leaves national courts freedom in assessing evidence. That freedom is not unlimited. A court must base its assessment on a logical, convincing and reasoned connection between the evidence presented and the decisive facts it establishes. For that reason, the question of the evidentiary value of digital communication cannot have a predetermined answer. In some cases, together with other evidence, it will represent a sufficiently firm basis for establishing the facts. In other cases, the same type of communication may leave open questions that cannot be resolved without additional evidence. The assessment of its evidentiary value always depends on the circumstances of the specific case, the quality of the other evidence presented, and the reasoning the court provides in its decision. Digital communication is, therefore, neither privileged nor of lesser value compared to other evidence. It is subject to the same rules of evidence law as any other evidence. Its persuasiveness does not derive from the technology through which it came into being, but from its capacity, together with the other evidence presented, to allow the court to establish the decisive facts beyond reasonable doubt.
Open Procedural Questions in SKY Cases
After the questions of the lawfulness of obtaining the data, its international transfer, and the general rules of evidence have been addressed, a series of procedural questions remains, arising in specific cases. These questions, as a rule, form the core of the dispute between the prosecution and the defense, and the basis on which the court builds its decision. Although every criminal offence and every piece of evidence must be considered individually, existing practice shows that certain dilemmas recur in almost every case where SKY communication is one of the key pieces of evidence.
The identity of the user of a particular SKY account is one of the first and most important questions in every SKY case. This question is resolved in practice through two distinct stages that should not be confused.
In the first stage, described earlier in the section on the technical background of the operation, French analysts generally did not know, nor did they need to know, who exactly stood behind a particular SKY identity. To them, it was an anonymous device exchanging messages, photographs and location data with other anonymous devices. The conclusion that an account probably belonged to the Montenegrin criminal world rested on a set of geographic, linguistic and network indicators, not on the established identity of a specific individual. Establishing the exact identity of the user, that is, linking a particular SKY account to a name and surname, is almost always the task of domestic investigative authorities, who allegedly have the local knowledge French analysts lack, and thus claim to know who uses which nickname, who drives which vehicle, who lives at which address, who is related to whom, and who is already subject to other covert surveillance measures. For that reason, orders and indictments of the Special State Prosecutor’s Office frequently contain the formulation that “based on the totality of the data collected, it follows that SKY identity XXXX is used by person Y.” A formulation that clearly reflects the fact that identification is not based on a single piece of evidence, but on a series of linked indicia. The mere fact that a particular name is mentioned in someone’s correspondence is not proof that that person is the user of the device. If the user of a SKY account writes “Dragan, I was at Jovan’s today,” that does not mean he himself is Dragan. He may be an associate, a driver, a relative, or an entirely different person. The conclusion about a user’s identity is usually drawn from an entirely different type of data. Photographs of a personal identity document sent by the user, photographs of a vehicle known from other sources to be used by that specific person, location matches between the device and places where, according to other evidence, that person was present, the way other participants address him, knowledge of details available only to a narrow circle of people, and photographs of family or home matching other evidence in the file. Only once a sufficient number of such mutually independent indicators align do investigative authorities conclude that there is a high probability the device was used by that specific person.
A more subtle legal question arises here as well. Establishing that the accused used the device is not the same as proving that he personally wrote every individual message from that device. The defense therefore legitimately raises questions such as whether the device could have been shared with another person, whether there is biometric evidence confirming who was operating the device at a given moment, whether there is video footage, a fingerprint or DNA trace, or any direct evidence that it was in fact the accused who typed a particular message. These questions become more serious the more identification relies predominantly, or exclusively, on indirect evidence. This does not mean, however, that such identification cannot be sufficient to bring charges, or even to secure a conviction. Criminal proceedings do not always require a single, direct, “perfect” piece of evidence of identity. A court may conclude that a particular person used a SKY device on the basis of a set of mutually independent indicia, provided a sufficient number of them align and mutually corroborate one another. Locations, photographs, the content of communication, other evidence gathered during the investigation, and witness testimony. For that reason, in SKY cases the identification of the user is almost never based solely on the content of messages, but on a combination of digital forensics, intelligence data and other evidence from the investigation, and the greatest dispute in these cases often does not concern what the messages say, but whether it has been proven beyond reasonable doubt that a particular SKY identity actually belonged to the specific accused. For that reason the court must clearly explain not only which facts it accepts, but also why it considers that their mutual relationship excludes other reasonable explanations.
Origin of digital content. Particular procedural questions may arise when certain photographs or other digital content form an important part of identifying a user or proving decisive facts. In certain cases, situations arise in which photographs existing on the accused’s private devices are also found in material used as part of the identification of SKY communication. That circumstance alone is not proof of unlawful conduct, nor does it automatically call the lawfulness of the evidence into question, but it opens a legitimate procedural question the court must clarify. What source a particular photograph comes from, how it became part of the evidentiary material, and what evidentiary value it has in the process of identifying the user of the communication. The greater the significance of particular digital content for identifying the accused, the greater the need for its origin to be clear and verifiable.
Completeness of communication. Digital communication is never an isolated message, but part of a much broader series of exchanges that often comprise hundreds or thousands of messages. It’s therefore a legitimate question whether the court has the complete communication or only isolated portions of it. This question matters not only because of the volume of data, but primarily because of context. The meaning of a particular message can depend on the messages preceding or following it. Where the court is presented with only part of the communication, there must be a way to verify whether its original meaning has been preserved and whether there are parts of the conversation that could be relevant to a proper assessment of the evidence presented.
Limits of expert analysis. Expert opinions based solely on photographs deserve particular attention. A photograph may be subject to expert analysis, but the possibilities of such an analysis are not unlimited, and practice shows both sides of this problem. On the one hand, there have been cases in which a conclusion that a photograph shows narcotics was reached solely on the basis of its appearance, without a chemical analysis of the substance itself. Such a finding, however much the appearance of the material may point to a particular conclusion, cannot substitute for what can only be established through laboratory testing, since the composition of a substance cannot be reliably determined visually. On the other hand, there are also examples of the opposite, and procedurally sounder, approach, where an expert asked to determine from a photograph whether a particular object was a firearm answered that this could not be established even at the level of the object’s basic category. In other words, the photograph did not permit a reliable conclusion as to whether the object was a firearm at all, let alone its technical characteristics. Such a finding is not a weakness of the expert opinion, but confirmation of the profession’s proper limits. An expert who acknowledges that a given conclusion cannot be drawn from the available photograph is acting exactly as professional diligence requires, while the opposite practice, drawing categorical conclusions where a photograph objectively does not allow them, represents precisely the kind of uncritical acceptance of digital evidence against which a court must guard. A photograph can be a significant evidentiary trace, but it cannot replace what can only be established by examining the item itself, or through appropriate laboratory or ballistic testing.
Proportionality of the measure and chain of custody. In addition to questions of identity, origin and completeness, courts across almost every European country debate several additional, broader questions that recur in SKY cases. The first is whether the French order authorizing the measure was sufficiently specific, or, on the contrary, too broad in relation to the number and scope of persons whose communication was intercepted. The second is whether the mass collection of communication from all users of the platform, rather than only predetermined individuals, was proportionate at all in terms of privacy guarantees. The third is whether the states that received the data have sufficiently precise information about the technical means by which it was obtained, so that the defense can effectively challenge the evidence, rather than relying solely on assurances that the measure was lawful. The fourth is whether the chain of custody has been preserved, that is, whether it’s possible to verify, for every stage from interception to the presentation of the evidence before the domestic court, who processed the data, when, and how, so as to exclude any possibility of alteration or loss of content. The fifth, finally, is the question of the reliability of the identification of the user itself, already discussed above.
It’s worth noting that courts across Europe have not taken a uniform position on these questions. In some states SKY evidence has generally been accepted as lawful, while in others, or in particular cases, courts have sought further explanation of how the data was obtained, or have limited its use precisely because of doubts about the proportionality of the measure and the chain of custody. This lack of uniformity does not by itself mean the evidence is unlawful, but it does confirm that these questions are genuinely contested, not a mere formality used by the defense to prolong proceedings.
Distinguishing facts from conclusions. Perhaps the most important procedural question in all SKY cases is distinguishing facts from conclusions. A distinction already mentioned in the section on the nature of digital evidence, which here proves to be the thread connecting all the previously discussed dilemmas. Questions of user identity, the origin of content, the completeness of communication and the limits of expert analysis ultimately come down to the same thing. Whether the conclusion drawn from a particular fact truly and necessarily follows from it. The court’s role is not merely to establish the content of digital communication, but to assess whether the conclusions drawn from that communication follow logically and convincingly from all the evidence presented. The procedural questions arising in SKY cases are, therefore, not a matter of trust or distrust in digital evidence. They are a natural consequence of the fact that digital evidence, like any other evidence in criminal proceedings, must be subjected to the same critical judicial assessment before it can serve as the basis for a conviction.
Digital Evidence, the Presumption of Innocence and the Burden of Proof
The presumption of innocence is one of the foundational principles of modern criminal procedure. Its substance is not exhausted by the rule that everyone is presumed innocent until proven guilty by a final judgment. It also entails that the burden of proof remains with the prosecution throughout the proceedings. This means it’s the prosecution’s duty to prove all facts constituting the elements of the offence, as well as the identity of the perpetrator, the existence of guilt, and other decisive circumstances on which the charge is based. The accused is not required to prove his innocence, nor to provide explanations that would compensate for gaps in the prosecution’s case. His right to remain silent and to challenge the evidence presented is an integral part of the right to a fair trial. These principles apply regardless of the nature of the evidence presented. Digital evidence cannot change the rules on the burden of proof. The fact that particular communication is technically complex, or contains a large number of messages, photographs or metadata, does not relieve the prosecution of its duty to prove every decisive fact on which the charge rests. The volume of digital data cannot substitute for its evidentiary value, nor can technical complexity justify lowering the standard of proof.
That is why, in cases where digital communication represents the predominant or decisive evidence, particular procedural care is required. Where a particular person is linked to a specific SKY PIN, it’s not enough to establish that the communication exists. It must be proven that the accused himself was the user of that account. Where communication contains a photograph alleged to show narcotics or a firearm, it’s not enough to establish that the photograph exists. The claims arising from it must be proven. Where communication discusses the commission of a particular offence, it’s not enough to establish the content of the conversation. It must be proven that the event referred to in the communication actually occurred. In other words, digital communication does not change the object of proof. It’s one of the possible means of evidence by which facts are established.
In this sense, it’s particularly important to distinguish the defense’s right to challenge evidence from the prosecution’s duty to prove the charge. The defense may point to shortcomings in user identification, challenge the authenticity or completeness of digital data, propose alternative interpretations of the content of the communication, or point to the existence of reasonable doubt. None of these circumstances changes the basic procedural rule. The prosecution bears the burden of proving every fact underlying the charge. A particular danger in cases based on large volumes of digital data is the possibility that the sheer number and interconnection of that data comes to be equated with its evidentiary strength. In such a situation there is a risk that, even unconsciously, the focus of the proceedings shifts from the question of whether the prosecution proved the charge to the question of whether the defense managed to challenge the digital data. Such an approach would be incompatible with the presumption of innocence. Criminal procedure recognizes no presumption of the accuracy of digital evidence, nor a presumption of the truthfulness of conclusions drawn from it. Like any other evidence, digital evidence is subject to the free evaluation of the court and must be assessed in relation to all the other evidence presented. That is why the development of new technologies does not require redefining basic procedural principles. On the contrary, the more technically complex a piece of evidence is, and the greater its significance for the final decision on guilt, the greater the need for consistent application of the presumption of innocence, the rules on the burden of proof, and the standard of proof beyond reasonable doubt. The digital age has not changed these principles. It has merely posed new challenges to their application.
Critical Judicial Scrutiny of Digital Evidence
A defining feature of modern criminal procedure is the free judicial evaluation of evidence. Free evaluation, however, does not mean arbitrary evaluation. A court is not authorized to accept or reject evidence without explanation. It must clearly state in its judgment why it regards particular evidence as credible, how it connects it to the other evidence presented, and on what basis it concludes that the decisive facts have been established beyond reasonable doubt. This rule takes on particular significance when proceedings rest to a large extent on digital evidence. Unlike classic material evidence, digital evidence most often passes through several stages of collection, processing, extraction, translation and analysis before being presented to the court. For that reason, judicial scrutiny cannot be limited to the content of the communication alone, but must also cover the way that content became part of the evidentiary material. This is where the significance of mutual legal assistance comes into play. The fact that particular evidence was obtained by foreign judicial authorities and delivered to the domestic court in accordance with the rules of international cooperation does not mean the domestic court also adopts those authorities’ factual or legal conclusions. The object of mutual legal assistance is the delivery of evidentiary material, not the transfer of a judicial assessment of that material. In other words, the domestic court does not adopt the conclusion that a particular user account was used by a specific person, nor the conclusion that particular communication proves the commission of an offence. It receives evidence which it is obliged to assess independently, in accordance with the rules of domestic criminal procedure. Herein lies the difference between international trust and judicial independence. International trust makes it possible for evidence to be used in domestic proceedings, judicial independence obliges the domestic court to subject that evidence to the same critical analysis applied to every other piece of evidence presented before it. For that reason, the fact that particular evidence was obtained or analyzed by foreign judicial authorities cannot, by itself, be a reason for a domestic court to abandon its duty to independently establish the facts it considers proven. A court does not adopt someone else’s conclusions, but rather the evidentiary material, while the conclusion as to what has been proven can be reached only on the basis of its own assessment of all the evidence presented. When a court fails to do this, it’s not merely a procedural shortcoming. The judiciary is one of the branches of state power, and it’s precisely its role to show that the state has the capacity and the will to arrive at the truth by its own means, rather than by simply accepting someone else’s conclusions. Avoiding one’s own powers and one’s own work, in the name of speed or convenience, raises above all a question of the sovereignty and self-respect of that branch of government, and only afterward a question of the correctness of a particular judgment.
Before basing a conviction predominantly or decisively on digital evidence, a court must therefore answer several key questions. First, has it been reliably established that the accused himself is the user of the digital account or communication attributed to him? Where a user’s identity follows from a series of indicia, the court must explain why it considers that their sum excludes other reasonable explanations. Further, it’s necessary to establish what the evidence presented actually is. Does the court have the original digital data, or a later processing of it? Where identification files, translations or analytical reports are used, their procedural nature and their relationship to the original data must be clarified. The court must then consider the authenticity and integrity of the digital content. Is there a way to verify that the data delivered corresponds to the original content, and is it possible to establish the origin of the photographs, documents and other digital records relevant to the decision? An important question concerns the completeness of the communication. Where only certain portions of a conversation are presented, the court must be satisfied that the extracted content does not change the meaning of the overall communication and that context has not been lost through selective choice of messages. Attention must also be paid to the evidentiary value of photographs and other digital content. The court must distinguish what a photograph objectively shows from the conclusions drawn from it. Where a particular conclusion requires expert knowledge, it must be examined whether the limits of the particular expert opinion allow such a conclusion to be drawn. Finally, the court must answer what is perhaps the most important question. Does the digital communication, viewed together with all the other evidence presented, actually confirm the decisive facts on which the charge rests, or does it represent only one segment of the overall evidentiary mosaic? Only after answering all of these questions is it possible to arrive at a final assessment of whether the standard of proof has been met. This approach does not represent the introduction of special rules for digital evidence, but the consistent application of traditional procedural principles to a new type of evidentiary material. A court must not presume the reliability of digital evidence simply because of its technical complexity, nor reject it in advance because it came into being through the use of modern technology. Its duty remains the same as for any other evidence, to critically examine its authenticity, credibility, evidentiary strength, and connection to the other evidence presented.
The essence of the free judicial evaluation of evidence lies precisely in this. It does not entail freedom to accept or reject evidence without explanation, but rather an obligation that every conclusion be the result of a logical, verifiable and reasoned analysis of all the evidence presented, in its mutual interconnection.
Has Digital Evidence Changed the Law of Evidence?
Since the appearance of the first digital evidence, the question has arisen whether modern technologies require new rules of proof, or whether existing procedural principles are broad enough to meet the challenges of the digital age.
At first glance, it might seem that the development of information technology imposes the need for entirely new rules. Digital evidence differs from traditional material evidence in the way it comes into being, is stored, processed and presented. It often does not exist in a single physical form, but as a body of data passing through several technical and procedural stages before being presented to the court. The essential question, however, is not whether evidence has changed, but whether the rules for evaluating it have changed. The answer, in this author’s view, must be negative. The basic principles of criminal procedure have remained the same. The court still decides on the basis of the free evaluation of evidence, the presumption of innocence still requires that the burden of proof rest with the prosecution, the standard of proof still requires that decisive facts be established beyond reasonable doubt, and the accused’s right to challenge evidence remains an integral part of the right to a fair trial. In other words, digital evidence has not changed the law of evidence, it has changed the subject matter to which those rules apply. There is therefore no need to create special procedural rules simply because a piece of evidence is digital. What is needed is the consistent application of existing rules to circumstances that are technically more complex than before.
This does not mean digital evidence poses no new challenges, on the contrary. Unlike classic evidence, where the court has direct access to the object of proof, digital evidence often represents the result of a multi stage process involving the collection of data, its processing, extraction, translation, analysis and the identification of the user. Each of these stages may be significant for the final assessment of evidentiary value. What changes, therefore, is not the rules of proof, but the intensity of their application. The more complex the path evidence travels from its creation to the courtroom, the greater the court’s duty to verify every stage of that path. The more technically sophisticated a piece of evidence, the greater the need for the court to understand how it came into being, and the greater the significance of a piece of evidence for the final decision on guilt, the more detailed the reasoning must be as to why the court considers it reliable. This is where the greatest challenge of the digital age truly lies. Not in the need to abandon traditional procedural principles, but in the need to apply them more consistently than ever before.
Digital evidence must not enjoy a privileged status simply because it came into being through the use of modern technology. Equally, it must not be called into question in advance simply because of its digital nature. Its evidentiary value must be assessed according to the same criteria applicable to any other evidence. The lawfulness of its acquisition, its authenticity, reliability, verifiability, connection to other evidence, and its capacity to contribute to establishing the decisive facts beyond reasonable doubt. This, in fact, is the most important lesson SKY cases teach. They have not changed the basic rules of criminal procedure, but have shown how important it is for those rules to be applied consistently even when the court is confronted, for the first time, with evidence whose technological complexity exceeds anything case law has previously encountered.
Conclusion
The use of communication obtained through the SKY ECC application has opened numerous questions that go beyond the framework of a single criminal case or a single type of evidence. It has posed a much broader question to the courts. How to apply traditional rules of evidence law to evidence that comes into being, is stored and is exchanged in a digital environment. An analysis of European and domestic case law shows there is no single answer to the question of the lawfulness of SKY communication. The reason for this is not inconsistency in case law, but the fact that this question in reality encompasses several different legal problems. One is the question of the lawfulness of obtaining the data in the state of its origin, another is the lawfulness of its international transfer, and a third, entirely separate question, is its evidentiary value in the specific criminal proceedings. Conflating these questions inevitably leads to mistaken legal conclusions. Likewise, the analysis shows that digital evidence does not constitute a special category of evidence exempt from the general rules of criminal procedure, but rather that the same procedural principles apply to it as to all other evidence. The presumption of innocence, the burden of proof, the free judicial evaluation of evidence, the right to a defense, and the standard of proof beyond reasonable doubt remain equally binding regardless of whether one is dealing with witness testimony, material traces, or digital communication.
For that reason, the technical complexity of digital evidence cannot be a reason for weaker judicial scrutiny. As already noted, the more complex the path evidence travels from its creation to the courtroom, the more stages of collection, processing, translation and international exchange it passes through, and the greater its significance for the final decision on guilt, the greater the court’s duty to verify its origin, authenticity, integrity and evidentiary value. It should also be kept in mind that mutual legal assistance does not entail the transfer of a judicial assessment of evidence. A domestic court may accept evidentiary material obtained from foreign judicial authorities, but it cannot adopt their factual or legal conclusions. It is obliged to independently determine whether the identity of the user has been properly established, whether the communication is authentic and complete, whether the conclusions drawn from it are logically reasoned, and whether all the evidence presented together excludes reasonable doubt as to the decisive facts.
The debate about SKY communication should not be a debate about whether to trust technology, but rather, above all, a debate about how a court should evaluate evidence created through the use of modern technologies. SKY ECC will, quite certainly, in time become just one of many digital platforms whose data is used in criminal proceedings. It will be replaced by other applications, new modes of communication and technologies that may not even exist yet today. What must not change, however, are the procedural standards that form the foundation of a fair trial. The law is not called upon to keep pace with technology by abandoning its principles. Its task is precisely the opposite, to apply the same principles consistently even as technology changes.
How far these questions are from academic abstraction is shown by the recent judgment of the Higher Court in Podgorica, in a case against members of a criminal organization alleged to have operated in Montenegro, as well as in South America, Africa, Europe and Australia. The accused received lengthy prison sentences, ranging from 8 to 40 years. According to the indictment of the Special State Prosecutor’s Office, part of the material incriminating the accused consisted precisely of communication intercepted through the SKY ECC platform. This is, however, a first instance judgment, so the very questions raised in this text (the lawfulness of obtaining and transferring the data, the reliability of user identification, the completeness of the communication, and its evidentiary value in relation to each individual count of the indictment) have yet to be assessed by the Court of Appeals, and potentially later by the Supreme Court. That case, in other words, has yet to show whether the standards discussed here are applied consistently in practice. Perhaps that is precisely why the greatest lesson of SKY cases does not lie in the answer to the question of whether a particular piece of digital evidence is lawful. It’s far more important to preserve the principle that no piece of evidence, regardless of how it came into being or how technically complex it is, can be exempt from critical, independent and impartial judicial assessment. The essence of the judicial function lies precisely in the duty to examine and assess every piece of evidence, which is at the same time the most important guarantee of the right to a fair trial.
