Knowledge section
Investigations
This section explains criminal investigation as a legally structured process rather than as a technique. It covers who may authorise investigative steps, why the chain of custody matters, what safeguards apply to interviews and searches, and how miscarriages of justice are identified and reviewed.
Start here
Foundational guides in this section, in reading order.
- “The police” is an incomplete answer almost everywhere. Legal responsibility for an investigation may rest with police, with a prosecutor, or with a judge — and the body that performs the work is often not the body that owns it.About 9 minutes to read
What is the difference between a police investigation and a prosecutor-led investigation?
Systems differ on who owns an investigation, who performs it, and who may direct whom. These are three separate questions, and the answers do not track each other — the body doing the work is frequently not the body responsible for it.About 10 minutes to readWhat does “judicial police” mean, and is it a police force?
One term, at least three different things. In France it is a legal function exercised by designated personnel; in Brazil an institutional role held by named forces; in Italy personnel drawn from other forces who fall under judicial direction. It almost never means police employed by the judiciary.About 8 minutes to readWhat is an investigating judge, and do all civil-law systems have one?
Two incompatible offices share this English name. In France and Belgium a judge conducts an investigation. In Germany a judge acts on the prosecution’s application and checks whether the requested act is lawful. Both are officially called investigating judges.About 10 minutes to readWhich institution is legally competent to investigate a particular crime?
Competence to investigate follows the offence, the level of government and sometimes the suspect — not simply the place. Two agencies can both be lawfully present at the same scene, and neither commands the other.About 9 minutes to readHow does a criminal investigation become a prosecution?
The familiar picture is a relay: police investigate, then hand a file to a prosecutor who decides. That describes some systems. In others the prosecutor was legally responsible from the first day, and there is no handover to describe.About 9 minutes to readWhat exactly does a legal system protect when it protects privacy?
Not one interest but several, bundled differently in each text. Switzerland puts private life, the home, mail and telecommunications in one article; South Africa defines privacy by the searches it forbids; Brazil separates intimacy from the house and both from communications.About 10 minutes to readWhat has to happen before officials may enter and search someone’s home?
Different things in different systems, and the differences are textual. Germany and Czechia require a judge; Spain accepts consent, a judicial decision or flagrante delicto; Brazil confines judicial authorisation to daytime; the Netherlands requires identification and a written report but no judge.About 11 minutes to readIs reading someone’s letters or listening to their calls treated like searching their home?
Not in the same way, and two neighbouring systems answer in opposite directions. The Netherlands requires a judge for communications but not for the home; Germany requires a judge for the home and, for some communications cases, replaces court recourse with parliamentary review.About 10 minutes to readIf investigators are technically able to obtain something, does that mean they may?
No, and two systems say so in terms. Japan’s Code permits compulsory measures only where the Code itself provides for them; Spain forbids authorising a technological measure to discover offences or to dispel suspicion that has no objective basis.About 9 minutes to readOfficials have taken a device. Does that mean they may read what is on it?
Taking a thing and reading it are separate legal acts, and in German law they belong to separate authorities: the examination of electronic storage media is the prosecution office’s, not the officers’ who hold the device.About 10 minutes to readIs listening to a conversation the same legal act as obtaining messages already stored?
No system read here treats them as one power. The Convention gives each its own article; Germany conditions them differently in the same code; and Japan’s Code excludes interception altogether, routing it to a separate Act.About 10 minutes to readIs who a person contacted treated the same as what they said?
No. Two instruments define the line in their own text — the Convention defines subscriber information as data "other than traffic or content data", and United States law excludes contents from the pen-register and subscriber-record definitions — and the three categories carry different conditions.About 11 minutes to readIf data has been "preserved", has anyone read it?
No. Preservation freezes material so that it still exists later; production hands it over. The Convention caps preservation at ninety days precisely because its purpose is to enable authorities to seek disclosure afterwards, by a separate power.About 8 minutes to readWho decides that an investigator may take a digital investigative step?
Not always a judge, and not always the same judge. One German power needs a single court, another a three-judge panel with a higher court taking over after six months; United States law allocates three different instruments to three categories; and the Convention requires "judicial or other independent supervision".About 11 minutes to readOnce a measure is authorised, what bounds it — and is the person ever told?
German law requires the order to state the measure’s type, extent, duration and end-point, then names measure by measure who must be notified afterwards and gives them two weeks to ask a court whether it was lawful and properly executed.About 11 minutes to readInvestigators are in one country and the data is in another. Whose law decides whether they may have it?
There is no single answer, because the instruments do not use the same connecting factor. One keys on where the data is stored, one on where the provider’s addressee is established, and one makes the data’s location expressly irrelevant.About 11 minutes to readHow does one state ask another for evidence?
Through a channel each Party designates and a body of law that mostly is not the treaty being invoked. The Convention’s own procedure applies only where no assistance treaty is in force between the two Parties, and its cooperation articles require each Party to legislate first.About 10 minutes to readCan one state ask another to freeze data before it has decided whether to ask for it?
Yes, and the two steps can get different answers for the same data. The Convention expressly removes dual criminality as a condition of preservation, while allowing a Party that requires it for disclosure to refuse preservation where it foresees the condition failing.About 10 minutes to readIs a cross-border request made to a country or to a company?
Both exist and they are different instruments. Mutual assistance and the European Investigation Order run state to state; a European Production Order is addressed to a provider’s establishment in another Member State; and the Second Additional Protocol contains one of each.About 11 minutes to readCan an authority in one country order a service provider in another country directly?
Under the Second Additional Protocol, for one category of data. Its direct route reaches specified, stored subscriber information only; traffic data requires going through the other Party, and content data is in neither.About 10 minutes to readWhat does the European Union framework for electronic evidence create, and does it operate yet?
Two orders addressed to a provider’s establishment in another Member State, under a Regulation applying from 18 August 2026. Who may issue one depends on the data category — and a prosecutor may order content preserved but not produced.About 12 minutes to readAn international instrument has been adopted. Does it work yet?
Adoption, entry into force, application and national implementation are four different facts, and four instruments read for this section sit at four different points. One states in its own text that its cooperation articles require Parties to legislate first.About 10 minutes to readDoes "subscriber data" mean the same thing in every instrument?
No. The Convention draws three categories and the European Union Regulation draws four, and the extra one is not a sub-case — it carries its own authorisation rule and its own exemption from the duty to notify the other Member State.About 10 minutes to readWhat is a criminal investigation?
A criminal investigation is a legally authorised process for establishing whether an offence occurred and gathering evidence that can be tested in court. This guide explains its structure, safeguards, and known failure modes.About 8 minutes to read
Key ideas
What makes this area difficult to understand from the outside.
An investigation is a legal process, not a hunt
Its steps are authorised, recorded, and later examined by people who were not present. Much of the work exists so that a decision can be reviewed afterwards.
Authorisation is the main constraint
Intrusive steps generally require approval from someone outside the investigating team — a supervisor, a prosecutor, a judge — at a defined threshold of suspicion. That external approval is the safeguard, and it is why investigations are slower than fiction suggests.
Evidence has a lifecycle
How material is found, recorded, stored, transferred, and examined determines whether it can be relied on at all. Chain-of-custody failures do not merely weaken evidence; they can remove it from the case entirely.
Investigators are required to test their own theory
Many systems place an explicit duty to pursue lines of enquiry that point away from a suspect. Confirmation bias is a documented and studied failure mode, not a hypothetical one.
Interview safeguards exist because of documented failures
Recording requirements, access to legal advice, and protections for vulnerable interviewees were introduced in response to established cases of unreliable admissions, not as abstract courtesies.
How this varies internationally
Who leads an investigation differs fundamentally between systems: police-led with prosecutorial oversight, prosecutor-led, or supervised by an investigating judge. The rest of the process follows from that difference. The difference does not track legal families — Germany, an archetypal civil-law system, has no judge who leads an investigation, and its prosecution carries the legal responsibility that police in other systems hold.
What this section does not cover
Stated explicitly. Scope discipline is a reader service, and in some cases an editorial safety rule.
- Investigative technique at operational specificity
- Surveillance capability, thresholds, or detection detail
- Anything that could assist evasion, concealment, or interference with an investigation