Alberto Ruiz-Gallardón, Spanish Minister of Justice, has ordered the design of a Criminal Procedure Code's draft, which authorises the police to install trojans on computers from guarded individuals.
The text might provide remote control over computers, including tablets and smartphones, related with sentences up to three years, cybercrime, terrorism, and organised crime. However, judges will have to justify the need of intervention before allowing police to take action.
According to the article 350 of the proposed draft, prosecutors may ask the judge for “the installation of a software that allows the remote examination and without knowledge of the owner of the content in computers, electronical devices, computer systems, instruments of massive storage or databases.”
In other words, the text allows the installation of trojans, a malware programme which is installed from different computers and that gives control over all the content without users' noticing it.
The measure will be only authorised when the information that has to be investigated is stored under Spanish jurisdiction (fully or partially). In other situations, police will have to follow international laws.
Furthermore, the article 351 of the text explains that official agents may require cooperation from “anyone who knows the operation of the computer system or measures applied in order to protect data held there". This means that Spanish authorities might require services from experts, “hackers” or computer companies.
The Spanish Ministry explained that despite the text proposed will be the basis of their draft, for the time being no decision was made regarding remote control of computers.
"We will listen carefully to what they will say on this matter, but we will not take a decision until we have discussed findings from different areas and groups," said a spokeswoman from the Ministry of Justice.
Experts on the matter explained that if the draft includes these rules, Spanish authorities will have also access to passwords that citizens use for their email, social profiles, bank accounts and other online services.
In addition, companies will have to collaborate with the police if they require the installation of surveillance systems, something that will go against privacy rights and data protection rules.