Skip to main content

Investigations

Officials have taken a device. Does that mean they may read what is on it?

Taking a thing and reading it are separate legal acts, and in German law they belong to separate authorities: the examination of electronic storage media is the prosecution office’s, not the officers’ who hold the device.

Fact-checkedSafety review clearedLast updated Last reviewed

In short

Two different things happen to a device in an investigation, and legal systems treat them as two different acts. One is taking it — removing it from someone’s control and holding it. The other is examining what is on it. The first is about an object; the second is about its contents, and the contents are usually where the intrusion is.

AnalysisThe systems read for this page keep the two apart in their text, and one of them keeps them apart institutionally as well.

Why it exists

AnalysisA device has to be taken before it can be examined, and the taking is often urgent — done at a scene, on the spot, by whoever is there. The examination is not urgent in the same way, is far more intrusive, and reaches material that has nothing to do with the offence: the same storage medium holds the thing being looked for and a person’s correspondence, photographs, finances and health.

How it works

German law separates the two acts across two provisions and then does something further. § 94(1) of the Strafprozessordnung provides that objects which may be of significance as evidence are to be taken into custody or otherwise secured; § 94(2) provides that where the objects are in a person’s custody and are not surrendered voluntarily, "so bedarf es der Beschlagnahme" — seizure is required. That is the taking.

The examination is § 110, and it belongs to someone else. § 110(1) provides that the Durchsicht of the papers of the person affected by the search "steht der Staatsanwaltschaft und auf deren Anordnung ihren Ermittlungspersonen" — belongs to the public prosecution office and, on its order, its investigators. § 110(2) provides that other officials may examine found papers only where the holder consents; failing that, they must place the papers they consider it necessary to examine in an envelope, seal it with the official seal in the holder’s presence, and deliver them to the prosecution office. § 110(3) applies the same regime to electronic storage media.

The Convention enumerates the powers separately
Article 19 of the Convention on Cybercrime lists them one by one. Article 19(1) is the power to search or similarly access a computer system or a computer-data storage medium. Article 19(3) is the power to seize or similarly secure, and it contains four distinct sub-powers: to seize or similarly secure the system or medium; to make and retain a copy of the data; to maintain the integrity of the stored data; and to render inaccessible or remove the data in the accessed system.
Copying is its own power
Article 19(3)(b) states the power to "make and retain a copy of those computer data" separately from the power to seize the medium in 19(3)(a). A system that has authorised one has not thereby authorised the other, and the Convention obliges Parties to provide for both because they do different things.
Japan distinguishes them inside the warrant
Article 218(1) of the Code of Criminal Procedure permits search, seizure or inspection upon a warrant issued by a judge. Article 219(1) then requires the warrant to state the name of the suspect or accused, the charged offence, the articles to be seized and, separately, the place, body or articles to be searched — together with a valid period, after which the measure may not be commenced and the warrant is returned to the court.
Spain conditions the whole family at once
Rather than separating the acts provision by provision, the LECrim chapter on technological measures subjects all of them to the same guiding principles in article 588 bis a — especialidad, idoneidad, excepcionalidad, necesidad and proporcionalidad — with idoneidad defining the objective and subjective scope of any measure by reference to its usefulness.

One further question arises only in the digital case: what happens when the material sought is reachable from the device but is not on it. German law answers narrowly. The second sentence of § 110(3) permits the examination to be extended to spatially separated storage media, but only so far as they can be accessed from the electronic storage medium and only where the loss of the sought data would otherwise be feared. Article 19(2) of the Convention permits a comparable extension where the further data is "lawfully accessible from or available to the initial system".

Common misconceptions

Widely held beliefs that do not match how the system actually operates.

  • Common belief: If officials have lawfully taken a device, they may examine what is on it.

    In practice: German law treats these as separate acts under separate provisions, and assigns the examination of electronic storage media to the public prosecution office rather than to whoever holds the device. Officials without that competence may examine found material only with the holder’s consent, and must otherwise seal it in the holder’s presence and deliver it.

  • Common belief: Seizing a device and copying its data are the same thing.

    In practice: Article 19(3) of the Convention on Cybercrime lists them as separate powers: to seize or similarly secure the system or medium at (a), and to make and retain a copy of the data at (b). Parties are obliged to provide for both.

  • Common belief: A warrant to search a place covers examining any device found there.

    In practice: Japan’s Article 219(1) requires the warrant to state the articles to be seized and, separately, the place, body or articles to be searched. The two are specified as different things within one instrument.

    What any particular warrant covers is a question about that warrant, and no case law was researched here.

  • Common belief: Examining a device is the same thing as forensic examination.

    In practice: They are different questions with different owners on this site. Whether there is legal authority to examine, and whose competence it is, is what this page describes. What an examination can scientifically establish, and whether a court may receive the result, is forensic science, and the forensics section owns it.

  • Common belief: Data that can be reached from a seized device is covered by the seizure.

    In practice: German law permits extending the examination to spatially separated storage media only where they are accessible from the medium being examined and where the loss of the sought data would otherwise be feared. The Convention’s Article 19(2) requires the further data to be lawfully accessible from the initial system. Both are conditioned extensions of an authorised act.

  • Common belief: Because examination is conditioned, devices cannot be examined.

    In practice: Every instrument read here provides for it. The Convention obliges Parties to establish the power to search or similarly access a computer system and to seize, copy and preserve data found there; German law provides for the Durchsicht of electronic storage media and permits data of significance to be secured.

How this varies between jurisdictions

A required section on every guide. Arrangements differ between countries, and we say how.

Four ways of keeping the acts apart.

  • Separate provisions and separate authorities — Germany, StPO § 94 for taking the object, § 110 for the examination, which belongs to the Staatsanwaltschaft.
  • Separately enumerated powers in one article — Council of Europe, Convention Art. 19(1) access, 19(3)(a) seizure of the medium, 19(3)(b) making and retaining a copy, 19(3)(c) maintaining integrity, 19(3)(d) rendering data inaccessible.
  • Separately specified within one warrant, with a valid period — Japan, CCP Arts. 218(1) and 219(1).
  • A single set of guiding principles governing the whole family of technological measures — Spain, LECrim art. 588 bis a.
  • Conditioned extension to storage not on the device — Germany, § 110(3) second sentence; Convention Art. 19(2).

Rights and accountability

The safeguard German law attaches to the handover is procedural rather than substantive: § 110(2) requires the envelope to be sealed with the official seal in the presence of the holder.

AnalysisThat is worth noticing because of what it does and does not decide. The person whose material it is witnesses the point at which it passes out of their sight. Nothing in the requirement settles whether the examination may happen at all; it settles whether what is examined is what was taken.

Article 19(4) of the Convention adds one power that sits oddly beside the others and is worth stating precisely: Parties shall empower their authorities to order any person who has knowledge about the functioning of the computer system, or the measures applied to protect data in it, to provide as is reasonable the necessary information to enable the search or access. What "as is reasonable" permits, and how it interacts with a person’s own protections against being compelled, is a question of each Party’s domestic law and was not researched.

What we could not establish

  • Germany and the Convention are described from primary text; Japan from an official reference translation whose version indicator reflects amendments to 2006 and may lag later ones. Spain’s chapter on technological measures was read for its guiding principles only, not for the article governing seizure of storage devices.
  • United States device-search law rests largely on constitutional case law, which this wave did not research. Nothing here is asserted about it.
  • Nothing on this page describes how any examination is performed, what any tool can do, or anything about how data on a device is stored or protected. That is a deliberate limit on the research.

Where to go next

Related: legal authority and technical capability, who authorises a digital investigative measure, and evidence integrity and admissibility.

Sources

  1. Strafprozessordnung (StPO) § 94 — Sicherstellung und Beschlagnahme von Gegenständen zu Beweiszwecken (German original text)

    Bundesministerium der Justiz / Bundesamt für Justiz (Gesetze im Internet) · Legislation · link verified 2026-09-05

    WAVE 22 ADDITION. The authoritative German text of the Code of Criminal Procedure, read directly from the official consolidated version. Supports § 94(1): “Gegenstände, die als Beweismittel für die Untersuchung von Bedeutung sein können, sind in Verwahrung zu nehmen oder in anderer Weise sicherzustellen.” Supports § 94(2): “Befinden sich die Gegenstände in dem Gewahrsam einer Person und werden sie nicht freiwillig herausgegeben, so bedarf es der Beschlagnahme.” — the coercive act of Beschlagnahme is required only where the item is in a person’s custody and is not surrendered voluntarily, which is what distinguishes it from Sicherstellung. Cited for the proposition that German law treats TAKING an item into official custody as a distinct legal act, governed by its own provision, from EXAMINING what the item contains, which is § 110. LIMITATIONS: this record supports the taking of the object and nothing about examining its contents; it states no threshold of suspicion, describes no procedure for executing a seizure, and supports no claim about any other country. The page displays no Stand date, so currency rests on the publisher. STATUS: current consolidated text as published at the verification date.

  2. Strafprozessordnung (StPO) § 110 — Durchsicht von Papieren und elektronischen Speichermedien (German original text)

    Bundesministerium der Justiz / Bundesamt für Justiz (Gesetze im Internet) · Legislation · link verified 2026-09-05

    WAVE 22 ADDITION. The authoritative German text, read directly. This is the provision on which the wave’s seizure/examination finding rests. Supports § 110(1): “Die Durchsicht der Papiere des von der Durchsuchung Betroffenen steht der Staatsanwaltschaft und auf deren Anordnung ihren Ermittlungspersonen (§ 152 des Gerichtsverfassungsgesetzes) zu.” — the examination belongs to the public prosecution office and, on its order, its investigators. Supports § 110(2): other officials are entitled to examine found papers only where the holder consents; failing that they must place the papers they consider it necessary to examine in an envelope, sealed with the official seal IN THE PRESENCE OF THE HOLDER, and deliver them to the prosecution office. Supports § 110(3): “Nach Maßgabe der Absätze 1 und 2 ist auch die Durchsicht von elektronischen Speichermedien bei dem von der Durchsuchung Betroffenen zulässig. Diese Durchsicht darf auch auf hiervon räumlich getrennte Speichermedien erstreckt werden, soweit auf sie von dem elektronischen Speichermedium aus zugegriffen werden kann, wenn andernfalls der Verlust der gesuchten Daten zu befürchten ist. Daten, die für die Untersuchung von Bedeutung sein können, dürfen gesichert werden.” Supports § 110(4), applying §§ 95a and 98(2) correspondingly where papers are taken away for examination or data provisionally secured. Cited for three propositions: that examining electronic storage media is a distinct legal act from seizing the medium; that in German law it is allocated to a different authority from the one that may hold the item; and that an authorised examination may be EXTENDED to spatially separated storage media accessible from the device, on a stated condition. LIMITATIONS: it describes no examination technique, no tool, and nothing about how any protection on a device operates; the page displays no Stand date. STATUS: current consolidated text at the verification date.

  3. Strafprozessordnung (StPO) § 100b — Online-Durchsuchung (German original text)

    Bundesministerium der Justiz / Bundesamt für Justiz (Gesetze im Internet) · Legislation · link verified 2026-09-05

    WAVE 22 ADDITION. The authoritative German text, read directly. Supports § 100b(1): even without the knowledge of the person concerned, technical means may be used to intervene in an information-technology system used by that person AND DATA MAY BE COLLECTED FROM IT (Online-Durchsuchung) where (1) specific facts ground the suspicion that someone has committed, or in punishable-attempt cases attempted, a BESONDERS SCHWERE STRAFTAT designated in subsection (2); (2) the offence weighs especially seriously also in the individual case; and (3) investigating the facts or determining the accused’s whereabouts by other means would be substantially more difficult or futile. Supports that § 100b(2) contains its own catalogue of qualifying offences, SEPARATE FROM AND NARROWER THAN the § 100a(2) catalogue. Cited for the proposition that one procedure code can contain two distinct digital powers with two distinct offence thresholds — the wave’s refutation of a single universal “digital search” standard. LIMITATIONS: it establishes the conditions of the power only; the authorising body, its composition, the duration and the renewal rules are in § 100e. It describes no technical means of any kind. STATUS: current consolidated text at the verification date.

  4. Convention on Cybercrime (Council of Europe, ETS No. 185, Budapest, 23 November 2001), Articles 14–21 and Chapter III (Articles 23–35)

    Council of Europe; consulted in the official treaty database of the Government of the Netherlands (wetten.overheid.nl, BWBV0001839) · International organisation · 2001-11-23 · link verified 2026-09-05

    WAVE 22 ADDITION. ACCESS NOTE: rm.coe.int and coe.int returned HTTP 403 to automated requests in this session, so the Convention was read from the official Dutch government treaty database, which publishes the authentic English text alongside the Dutch translation. The English text quoted below is the authentic one; English and French are the authentic languages. Supports Art. 14(1)–(2), that the procedural powers are established “for the purpose of specific criminal investigations or proceedings” and are applied to the offences established under Arts. 2–11, to other criminal offences committed by means of a computer system, and to “the collection of evidence in electronic form of a criminal offence”. Supports Art. 14(3)(a), that a Party restricting the Art. 20 power to specified offences must not restrict it more narrowly than the range to which it applies Art. 21. Supports Art. 15(1), that the powers are subject to conditions and safeguards under domestic law providing adequate protection of human rights, including rights under the 1950 European Convention and the 1966 Covenant, “and which shall incorporate the principle of proportionality”. Supports Art. 15(2), that such conditions and safeguards shall, as appropriate, “include judicial or other independent supervision, grounds justifying application, and limitation of the scope and the duration of such power or procedure”. Supports Art. 16(1)–(3): expedited preservation of specified stored computer data “including traffic data”, in particular where it is particularly vulnerable to loss or modification; where effected by order to a person, an obligation to preserve and maintain integrity “for a period of time as long as necessary, up to a maximum of ninety days, to enable the competent authorities to seek its disclosure”, renewable; and an obligation on the custodian to keep the undertaking of the procedure confidential. Supports Art. 17, expedited preservation and PARTIAL disclosure of traffic data sufficient to identify the service providers and the path through which the communication was transmitted. Supports Art. 18(1)(a)–(b), the production order: a person in the territory to submit specified stored computer data in that person’s possession or control, and a service provider offering services in the territory to submit subscriber information. Supports Art. 18(3), which defines “subscriber information” as information held by a service provider relating to subscribers of its services “OTHER THAN TRAFFIC OR CONTENT DATA” and by which the type of service, the subscriber’s identity, postal or geographic address, telephone and other access number, billing and payment information, and information on the site of installation of communication equipment can be established. Supports Art. 19(1)–(4): the power to search or similarly access a computer system or a computer-data storage medium; the power under 19(2) to EXTEND the search expeditiously to another system in the territory where the data sought is “lawfully accessible from or available to the initial system”; the power under 19(3) to seize or similarly secure, comprising the separate powers to “seize or similarly secure a computer system or part of it or a computer-data storage medium”, to “make and retain a copy of those computer data”, to “maintain the integrity of the relevant stored computer data”, and to “render inaccessible or remove those computer data in the accessed computer system”; and the power under 19(4) to order any person with knowledge about the functioning of the system to provide, as is reasonable, the necessary information. Supports Art. 20, real-time collection of TRAFFIC data, and Art. 21, interception of CONTENT data, the latter available only “in relation to a range of serious offences to be determined by domestic law”; both articles oblige a service provider to keep the execution confidential. Cited for the structural propositions that preservation is a distinct act from production, that traffic data and content data are distinct powers, that subscriber information is defined by exclusion from both, and that seizing, copying and accessing are separately enumerated. LIMITATIONS, and they are load-bearing: this is a TREATY. It obliges Parties to establish powers in domestic law; it is NOT evidence of what any particular Party has enacted, and no country claim on this platform rests on it. It describes no technique. STATUS: in force; the Convention has two additional protocols, of which the Second Additional Protocol on enhanced co-operation and disclosure of electronic evidence was located but NOT read for this wave. WAVE 23 ADDITION. That Protocol has now been read and is held separately as `coe-cybercrime-second-protocol`. Chapter III of the Convention, on international co-operation, was read from the same authentic English text, and it is a different subject from the domestic powers above. Supports Art. 23, that Parties co-operate “in accordance with the provisions of this chapter, and through the application of relevant international instruments on international co-operation in criminal matters, arrangements agreed on the basis of uniform or reciprocal legislation, and domestic laws”. Supports Art. 25(1)-(4), and in particular Art. 25(2), that “Each Party shall also adopt such legislative and other measures as may be necessary to carry out the obligations set forth in Articles 27 through 35” -- the Convention’s own statement that its co-operation articles are not self-executing -- and Art. 25(4), that except as specifically provided “mutual assistance shall be subject to the conditions provided for by the law of the requested Party or by applicable mutual assistance treaties, including the grounds on which the requested Party may refuse co-operation”. Supports Art. 27(1), that the Article applies only “where there is no mutual assistance treaty or arrangement on the basis of uniform or reciprocal legislation in force between the requesting and requested Parties”, and Art. 27(2)(a)-(d), that each Party designates a central authority “responsible for sending and answering requests for mutual assistance, the execution of such requests or their transmission to the authorities competent for their execution”, that central authorities communicate directly with each other, and that the Secretary General keeps a register of them. Supports Art. 29(1)-(4): a Party may request another to preserve data “located within the territory of that other Party and in respect of which the requesting Party intends to submit a request for mutual assistance”; the request must state that intention (29(2)(f)); “For the purposes of responding to a request, dual criminality shall not be required as a condition to providing such preservation” (29(3)); and a Party that requires dual criminality for disclosure may reserve the right to refuse preservation where it has reasons to believe the condition cannot be fulfilled at the time of disclosure (29(4)). Supports Art. 30(1)-(2), expedited disclosure of a sufficient amount of preserved traffic data to identify a service provider in another State and the path through which the communication was transmitted, withholdable only for a political offence or where execution is likely to prejudice sovereignty, security, ordre public or other essential interests. Supports Art. 31(1)-(3), mutual assistance to search, seize and disclose stored data “including data that has been preserved pursuant to Article 29”, responded to on an expedited basis where data is particularly vulnerable to loss. Supports Art. 32 IN FULL, and its narrowness is the point: “A Party may, without the authorisation of another Party: a) access publicly available (open source) stored computer data, regardless of where the data is located geographically; or b) access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system.” There is no third limb and no unilateral remote-access provision. Supports Art. 33(1)-(2), mutual assistance in the real-time collection of traffic data, governed by the conditions and procedures of domestic law and available at least for offences for which such collection would be available in a similar domestic case; and Art. 34, mutual assistance regarding the interception of content data “to the extent permitted under their applicable treaties and domestic laws”. Supports Art. 35(1)-(2), that each Party designates a point of contact available twenty-four hours a day, seven days a week, to ensure immediate assistance -- facilitating or, if permitted by its domestic law and practice, directly carrying out technical advice, preservation under Arts. 29 and 30, and the collection of evidence, provision of legal information and locating of suspects -- and that where the point of contact is not part of the Party’s authority responsible for international mutual assistance, it must ensure co-ordination with that authority. LIMITATION ON CHAPTER III, restated because it is easy to lose: these are obligations on Parties to legislate and to co-operate. They are NOT evidence of what any Party has enacted. The Party list, signature dates and ratification counts were NOT RESEARCHED, because the Council of Europe Treaty Office returned HTTP 403 to three separate URL forms.

  5. Code of Criminal Procedure (刑事訴訟法), English translation

    Ministry of Justice (Japanese Law Translation database) · Legislation · 1948 · link verified 2026-07-25

    Cited from the official Japanese Law Translation database (reference only; original Japanese text has legal effect). Supports, at the structural level: that police officials act as judicial police officials investigating offences (Article 189); that public prosecutors may themselves investigate offences (Article 191); and that prosecution is instituted by a public prosecutor (Article 247), who holds the discretion whether to prosecute. Supports the allocation of investigative and charging responsibility; the English is not authoritative and no operational detail is drawn from it. WAVE 22 ADDITION. Read again from the same Japanese Law Translation page, this time from the database's own XML export of the Code (s23Aa001310201en2.0_h18A36.xml), fetched with the law page as referrer. TEMPORAL LIMITATION, stated because it is load-bearing for this wave: the version identifier indicates a translation reflecting amendments to 2006, so it MAY LAG later amendments, and only structural propositions present in that version are drawn from it. Supports Art. 197(1): with regard to investigation, “such examination as is necessary to achieve its objective may be conducted; provided, however, that compulsory dispositions shall not be applied unless special provisions have been established in this Code.” Supports Art. 218(1), that a public prosecutor, a public prosecutor's assistant officer or a judicial police official may, if necessary for investigation of an offense, conduct search, seizure or inspection UPON A WARRANT ISSUED BY A JUDGE, and Art. 218(3), that the warrant is issued upon their request. Supports Art. 219(1), that the warrant shall contain the name of the suspect or accused, the charged offense, THE ARTICLES TO BE SEIZED or the place, body or articles to be searched, the place or articles to be inspected, the valid period, and a statement that the search, seizure or inspection shall not be commenced after the lapse of that period and that the warrant shall then be returned to the court. Supports Art. 222-2 in full: “Compulsory measures for the interception of electronic communications without the consent of either party shall be executed based upon other acts.” Cited for three propositions: that a national code can state as a general rule that a compulsory measure requires a specific statutory provision; that the warrant instrument itself distinguishes what may be seized from what may be searched; and that a system may place the interception power OUTSIDE its general procedure code. The Act to which Art. 222-2 refers was NOT read, and this record supports no claim about its content. The English is a reference translation and the Japanese text has legal effect.

  6. Ley de Enjuiciamiento Criminal, arts. 588 bis a, 588 bis b y 588 bis e — disposiciones comunes a las medidas de investigación tecnológica

    Agencia Estatal Boletín Oficial del Estado (BOE) · Legislation · 1882-09-14 · link verified 2026-09-05

    WAVE 22 ADDITION. The consolidated Spanish text of the Criminal Procedure Act, read directly from the BOE. The articles cited were INSERTED by article único.13 of Ley Orgánica 13/2015 of 5 October (BOE-A-2015-10725), published 06/10/2015 and IN FORCE FROM 06/12/2015 — the BOE records that provenance against each article and it is reproduced here because the chapter postdates the rest of the Act by 133 years. Supports art. 588 bis a (Principios rectores) in full: measures in the chapter may be ordered during the instruction of proceedings only with judicial authorisation “dictada con plena sujeción a los principios de especialidad, idoneidad, excepcionalidad, necesidad y proporcionalidad de la medida”; that especialidad requires the measure to relate to the investigation of a specific offence and that “No podrán autorizarse medidas de investigación tecnológica que tengan por objeto prevenir o descubrir delitos o despejar sospechas sin base objetiva”; that idoneidad defines the objective and subjective scope and the duration of the measure by reference to its usefulness; that under excepcionalidad and necesidad the measure may be ordered only where no other less burdensome and equally useful measures are available, or where the investigation would otherwise be gravely hindered; and that a measure is proportionate only where, taking all the circumstances into account, the sacrifice of the rights and interests affected is not greater than the benefit to the public interest and to third parties, the public interest being weighed by the gravity of the act, its social significance or the technological sphere in which it was produced, the strength of the existing indicia and the relevance of the result pursued. Supports art. 588 bis b: the judge may order the measures of his own motion or at the instance of the Ministerio Fiscal or the Policía Judicial, and where the Fiscal or the Policía Judicial applies, the petition must contain eight enumerated items including the identity of the person investigated “o de cualquier otro afectado por la medida”, the reasons justifying necessity under the guiding principles, the extension of the measure with specification of its content, the investigating unit that will carry it out, the form of execution, the duration sought and the obliged subject. Supports art. 588 bis e: the measures have the duration specified for each and may not exceed the time indispensable for clarifying the facts; extension is by auto motivado of the competent judge; and once the period expires without extension the measure “cesará a todos los efectos”. LIMITATIONS: only these three articles of the chapter were read. Articles 588 ter to 588 octies, which contain the individual measures, were NOT read, and no claim about any specific Spanish measure rests on this record. It describes no technique. STATUS: current consolidated text at the verification date.