Investigations
How does one state ask another for evidence?
Through a channel each Party designates and a body of law that mostly is not the treaty being invoked. The Convention’s own procedure applies only where no assistance treaty is in force between the two Parties, and its cooperation articles require each Party to legislate first.
In short
Mutual legal assistance is the formal route by which one State asks another to do something on its territory for a criminal investigation — search a place, seize a thing, take a statement, or obtain data. It is a request between States, executed by the receiving State under its own law.
Why it exists
AnalysisThe alternative to asking is acting, and acting on another State’s territory without its agreement is the thing the whole structure exists to avoid. Mutual assistance converts what would otherwise be an intrusion into a request that the receiving State evaluates against its own law — which is why the receiving State’s refusal grounds are part of the mechanism rather than an obstacle to it.
How it works
The Convention on Cybercrime states the general obligation in Article 25(1): Parties shall afford one another mutual assistance "to the widest extent possible" for investigations or proceedings concerning offences related to computer systems and data, or for the collection of evidence in electronic form of a criminal offence. Article 23 then says how — through this chapter, and "through the application of relevant international instruments on international co-operation in criminal matters, arrangements agreed on the basis of uniform or reciprocal legislation, and domestic laws".
Article 27 makes that explicit. Its procedures apply only "where there is no mutual assistance treaty or arrangement on the basis of uniform or reciprocal legislation in force between the requesting and requested Parties", and expressly do not apply where such a treaty exists unless the Parties agree otherwise. The Convention’s own procedure is a fallback.
Where it does apply, Article 27(2) supplies the institutional answer: each Party designates a central authority "responsible for sending and answering requests for mutual assistance, the execution of such requests or their transmission to the authorities competent for their execution"; central authorities communicate directly with each other; each Party notifies the names to the Secretary General of the Council of Europe, who keeps a register.
Alongside that formal channel the Convention creates a second, faster one. Article 35 requires each Party to designate a point of contact available twenty-four hours a day, seven days a week, to ensure immediate assistance — facilitating or, where domestic law and practice permit, directly carrying out technical advice, preservation under Articles 29 and 30, and the collection of evidence, provision of legal information and locating of suspects. Article 35(2)(b) contemplates that this point of contact may not be part of the authority responsible for mutual assistance, and requires coordination between them where it is not.
Within the European Union a further instrument operates between Member States. Article 1(1) of Directive 2014/41/EU defines a European Investigation Order as "a judicial decision which has been issued or validated by a judicial authority of a Member State … to have one or several specific investigative measure(s) carried out in another Member State … to obtain evidence", executed under Article 1(2) "on the basis of the principle of mutual recognition". Article 1(3) adds something unusual: the issuing of an EIO may be requested by a suspected or accused person, or by a lawyer on their behalf, within applicable defence rights.
Common misconceptions
Widely held beliefs that do not match how the system actually operates.
Common belief: A treaty on cooperation sets out the procedure for making a request.
In practice: Article 23 of the Convention directs cooperation through other international instruments, reciprocal arrangements and domestic laws. Article 27 applies only where no assistance treaty is in force between the two Parties.
Common belief: A central authority is a court, or a prosecutor’s office.
In practice: Article 27(2)(a) describes it by function — sending, answering, executing, or transmitting to the authorities competent for execution — and not by institutional type. What it is in any system is a matter for that system.
Common belief: Once a request arrives, the receiving state must carry it out.
In practice: Article 25(4) provides that mutual assistance is subject to the conditions provided for by the law of the requested Party or by applicable treaties, "including the grounds on which the requested Party may refuse co-operation".
Common belief: A European Investigation Order and a request for mutual assistance are the same thing.
In practice: An EIO is a judicial decision executed on the principle of mutual recognition, and Article 1(3) allows a suspected or accused person to request that one be issued. Neither feature belongs to mutual assistance generally.
Common belief: The 24/7 point of contact can do whatever a mutual assistance request could.
In practice: Article 35(1) lets it facilitate the listed measures, and carry them out directly only "if permitted by its domestic law and practice". Article 35(2)(b) contemplates that it may not even be part of the mutual assistance authority.
Common belief: Cooperation between states means every state uses the same mechanism.
In practice: The Convention routes through existing instruments, its own Article 27 applies only as a fallback, its Article 35 creates a separate faster channel, and within the European Union the EIO and — for electronic evidence — the production and preservation orders operate as well.
How this varies between jurisdictions
A required section on every guide. Arrangements differ between countries, and we say how.
Channels, and what governs each.
- Through whatever instruments, reciprocal arrangements and domestic laws already apply — Convention Art. 23.
- Through the Convention’s own procedure, but only where no assistance treaty is in force between the Parties — Art. 27(1).
- Via a designated central authority whose functions may be to send, answer, execute or transmit — Art. 27(2)(a).
- Via a 24/7 point of contact for immediate assistance, doing directly only what domestic law and practice permit — Art. 35(1), (2)(b).
- Between EU Member States, by a judicial decision executed on mutual recognition, which a suspected or accused person may ask to have issued — Directive 2014/41/EU, Art. 1(1)–(3).
- And in every case subject to the requested Party’s law and its refusal grounds — Art. 25(4).
Rights and accountability
AnalysisThe refusal grounds are the safeguard that travels with the request. Because Article 25(4) subjects assistance to the requested Party’s own law, the evidence is gathered under the standards of the State where it is gathered — which is a different guarantee from the one the requesting State would have applied, and is why the two questions are worth keeping apart.
What we could not establish
- The Convention’s cooperation chapter and Article 1 of the European Investigation Order Directive were read. No bilateral mutual assistance treaty was read, and no national mutual assistance legislation was read for any country.
- How long any request takes, how often requests are made, and how any State responds in practice are outside this page and were not researched. No such figure appears anywhere in this wave.
- Nothing here describes how a request is prepared, transmitted or executed. That is a deliberate limit on the research.
Where to go next
Related: jurisdiction over foreign-held data, cross-border preservation and disclosure, and asking a state and ordering a provider.
Related topics
- Investigators are in one country and the data is in another. Whose law decides whether they may have it?
There is no single answer, because the instruments do not use the same connecting factor. One keys on where the data is stored, one on where the provider’s addressee is established, and one makes the data’s location expressly irrelevant.
- Can one state ask another to freeze data before it has decided whether to ask for it?
Yes, and the two steps can get different answers for the same data. The Convention expressly removes dual criminality as a condition of preservation, while allowing a Party that requires it for disclosure to refuse preservation where it foresees the condition failing.
- An international instrument has been adopted. Does it work yet?
Adoption, entry into force, application and national implementation are four different facts, and four instruments read for this section sit at four different points. One states in its own text that its cooperation articles require Parties to legislate first.
- Which institution is legally competent to investigate a particular crime?
Competence to investigate follows the offence, the level of government and sometimes the suspect — not simply the place. Two agencies can both be lawfully present at the same scene, and neither commands the other.
Sources
Council of Europe; consulted in the official treaty database of the Government of the Netherlands (wetten.overheid.nl, BWBV0001839) · International organisation · 2001-11-23 · link verified 2026-09-05
WAVE 22 ADDITION. ACCESS NOTE: rm.coe.int and coe.int returned HTTP 403 to automated requests in this session, so the Convention was read from the official Dutch government treaty database, which publishes the authentic English text alongside the Dutch translation. The English text quoted below is the authentic one; English and French are the authentic languages. Supports Art. 14(1)–(2), that the procedural powers are established “for the purpose of specific criminal investigations or proceedings” and are applied to the offences established under Arts. 2–11, to other criminal offences committed by means of a computer system, and to “the collection of evidence in electronic form of a criminal offence”. Supports Art. 14(3)(a), that a Party restricting the Art. 20 power to specified offences must not restrict it more narrowly than the range to which it applies Art. 21. Supports Art. 15(1), that the powers are subject to conditions and safeguards under domestic law providing adequate protection of human rights, including rights under the 1950 European Convention and the 1966 Covenant, “and which shall incorporate the principle of proportionality”. Supports Art. 15(2), that such conditions and safeguards shall, as appropriate, “include judicial or other independent supervision, grounds justifying application, and limitation of the scope and the duration of such power or procedure”. Supports Art. 16(1)–(3): expedited preservation of specified stored computer data “including traffic data”, in particular where it is particularly vulnerable to loss or modification; where effected by order to a person, an obligation to preserve and maintain integrity “for a period of time as long as necessary, up to a maximum of ninety days, to enable the competent authorities to seek its disclosure”, renewable; and an obligation on the custodian to keep the undertaking of the procedure confidential. Supports Art. 17, expedited preservation and PARTIAL disclosure of traffic data sufficient to identify the service providers and the path through which the communication was transmitted. Supports Art. 18(1)(a)–(b), the production order: a person in the territory to submit specified stored computer data in that person’s possession or control, and a service provider offering services in the territory to submit subscriber information. Supports Art. 18(3), which defines “subscriber information” as information held by a service provider relating to subscribers of its services “OTHER THAN TRAFFIC OR CONTENT DATA” and by which the type of service, the subscriber’s identity, postal or geographic address, telephone and other access number, billing and payment information, and information on the site of installation of communication equipment can be established. Supports Art. 19(1)–(4): the power to search or similarly access a computer system or a computer-data storage medium; the power under 19(2) to EXTEND the search expeditiously to another system in the territory where the data sought is “lawfully accessible from or available to the initial system”; the power under 19(3) to seize or similarly secure, comprising the separate powers to “seize or similarly secure a computer system or part of it or a computer-data storage medium”, to “make and retain a copy of those computer data”, to “maintain the integrity of the relevant stored computer data”, and to “render inaccessible or remove those computer data in the accessed computer system”; and the power under 19(4) to order any person with knowledge about the functioning of the system to provide, as is reasonable, the necessary information. Supports Art. 20, real-time collection of TRAFFIC data, and Art. 21, interception of CONTENT data, the latter available only “in relation to a range of serious offences to be determined by domestic law”; both articles oblige a service provider to keep the execution confidential. Cited for the structural propositions that preservation is a distinct act from production, that traffic data and content data are distinct powers, that subscriber information is defined by exclusion from both, and that seizing, copying and accessing are separately enumerated. LIMITATIONS, and they are load-bearing: this is a TREATY. It obliges Parties to establish powers in domestic law; it is NOT evidence of what any particular Party has enacted, and no country claim on this platform rests on it. It describes no technique. STATUS: in force; the Convention has two additional protocols, of which the Second Additional Protocol on enhanced co-operation and disclosure of electronic evidence was located but NOT read for this wave. WAVE 23 ADDITION. That Protocol has now been read and is held separately as `coe-cybercrime-second-protocol`. Chapter III of the Convention, on international co-operation, was read from the same authentic English text, and it is a different subject from the domestic powers above. Supports Art. 23, that Parties co-operate “in accordance with the provisions of this chapter, and through the application of relevant international instruments on international co-operation in criminal matters, arrangements agreed on the basis of uniform or reciprocal legislation, and domestic laws”. Supports Art. 25(1)-(4), and in particular Art. 25(2), that “Each Party shall also adopt such legislative and other measures as may be necessary to carry out the obligations set forth in Articles 27 through 35” -- the Convention’s own statement that its co-operation articles are not self-executing -- and Art. 25(4), that except as specifically provided “mutual assistance shall be subject to the conditions provided for by the law of the requested Party or by applicable mutual assistance treaties, including the grounds on which the requested Party may refuse co-operation”. Supports Art. 27(1), that the Article applies only “where there is no mutual assistance treaty or arrangement on the basis of uniform or reciprocal legislation in force between the requesting and requested Parties”, and Art. 27(2)(a)-(d), that each Party designates a central authority “responsible for sending and answering requests for mutual assistance, the execution of such requests or their transmission to the authorities competent for their execution”, that central authorities communicate directly with each other, and that the Secretary General keeps a register of them. Supports Art. 29(1)-(4): a Party may request another to preserve data “located within the territory of that other Party and in respect of which the requesting Party intends to submit a request for mutual assistance”; the request must state that intention (29(2)(f)); “For the purposes of responding to a request, dual criminality shall not be required as a condition to providing such preservation” (29(3)); and a Party that requires dual criminality for disclosure may reserve the right to refuse preservation where it has reasons to believe the condition cannot be fulfilled at the time of disclosure (29(4)). Supports Art. 30(1)-(2), expedited disclosure of a sufficient amount of preserved traffic data to identify a service provider in another State and the path through which the communication was transmitted, withholdable only for a political offence or where execution is likely to prejudice sovereignty, security, ordre public or other essential interests. Supports Art. 31(1)-(3), mutual assistance to search, seize and disclose stored data “including data that has been preserved pursuant to Article 29”, responded to on an expedited basis where data is particularly vulnerable to loss. Supports Art. 32 IN FULL, and its narrowness is the point: “A Party may, without the authorisation of another Party: a) access publicly available (open source) stored computer data, regardless of where the data is located geographically; or b) access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system.” There is no third limb and no unilateral remote-access provision. Supports Art. 33(1)-(2), mutual assistance in the real-time collection of traffic data, governed by the conditions and procedures of domestic law and available at least for offences for which such collection would be available in a similar domestic case; and Art. 34, mutual assistance regarding the interception of content data “to the extent permitted under their applicable treaties and domestic laws”. Supports Art. 35(1)-(2), that each Party designates a point of contact available twenty-four hours a day, seven days a week, to ensure immediate assistance -- facilitating or, if permitted by its domestic law and practice, directly carrying out technical advice, preservation under Arts. 29 and 30, and the collection of evidence, provision of legal information and locating of suspects -- and that where the point of contact is not part of the Party’s authority responsible for international mutual assistance, it must ensure co-ordination with that authority. LIMITATION ON CHAPTER III, restated because it is easy to lose: these are obligations on Parties to legislate and to co-operate. They are NOT evidence of what any Party has enacted. The Party list, signature dates and ratification counts were NOT RESEARCHED, because the Council of Europe Treaty Office returned HTTP 403 to three separate URL forms.
Directive 2014/41/EU regarding the European Investigation Order in criminal matters, Article 1
Publications Office of the European Union (EUR-Lex) · International organisation · 2014-04-03 · link verified 2026-09-05
WAVE 23 ADDITION. Read directly on EUR-Lex, and cited for one purpose only: to state what a European Investigation Order IS in its own words, so that the contrast with a European Production Order rests on both instruments rather than on one instrument’s description of the other. Supports Art. 1(1): “A European Investigation Order (EIO) is a judicial decision which has been issued or validated by a judicial authority of a Member State (‘the issuing State’) to have one or several specific investigative measure(s) carried out in another Member State (‘the executing State’) to obtain evidence in accordance with this Directive”, and that an EIO may also be issued for obtaining evidence already in the possession of the executing State’s competent authorities. Supports Art. 1(2), that Member States execute an EIO “on the basis of the principle of mutual recognition”. Supports Art. 1(3), that the issuing of an EIO may be requested by a suspected or accused person, or by a lawyer on his behalf, within the framework of applicable defence rights. Supports Art. 1(4), that the Directive does not modify the obligation to respect fundamental rights and legal principles enshrined in Art. 6 TEU. LIMITATIONS: only Article 1 was read. Nothing about grounds for refusal, formalities, time limits, specific investigative measures or the Directive’s temporal status is established by this record, and no claim about any Member State’s implementation rests on it.