When the investigation invades the system

State hacking, digital evidence, and the limits of legality

Abstract

The expansion of digital investigative techniques has moved criminal prosecution beyond the seizure of physical devices toward covert and remote access to systems and data. State hacking and malware infiltration may produce substantial investigative gains, but they can also reach communications, files, cameras, microphones, and location data while altering the very environment in which evidence is generated. This editorial argues that innovation cannot operate without statutory authorization, technical transparency, effective adversarial participation, and an auditable chain of custody. The absence of a specific framework, including the regulatory gap associated with the proposed Criminal Data Protection Law, does not authorize unlimited investigative powers or decisions based on institutional trust. The article proposes concrete parameters for authorizing, conducting, preserving, and reviewing these measures, distinguishing the capacity to discover information from the legitimacy of converting it into reliable evidence.