Analysing large amounts of data goes to the heart of the challenges confronting intelligence and law enforcement professionals today. Increasingly, this involves Internet data that are ‘open source’ or ‘publicly available’. Projects such as the European FP7 VIRTUOSO aim at developing platforms for open-source intelligence by law enforcement and public security, which open up opportunities for large-scale, automated data gathering and analysis. However, the mere fact that data are publicly available does not imply an absence of restrictions to researching them. This paper investigates one area of legal constraints, namely Dutch criminal-procedure law in relation to open-source data gathering by the police. Which legal basis is there for this activity? And under what conditions can foreign open sources be investigated?
After sketching the context of the VIRTUOSO project and legal constraints of open-source intelligence in general, this paper discusses provisions of the Dutch Police Act 1993 and the Code of Criminal Procedure to determine which is the correct legal basis for gathering data from openly accessible and semi-open sources. Next, cross-border gathering of data is discussed on the basis of article 32 of the Cybercrime Convention. The paper draws the conclusion that investigating open sources by the police will often go beyond what is allowed on the basis of the general task description of the police (art. 2 Police Act 1993); hence, an order from the Public Prosecutor for systematic observation or intelligence is required. Moreover, the tools used must meet the non-manipulability and auditing requirements of the Dutch Decree on Technical Devices in Criminal Procedure.