Sidelights | The Past, Present, and Future of the Technological Investigation Act

Moderator: Chiu Tzu-ting / Attorney, Member of the Digital Law and Policy Group, JRF

Speaker: Lin Chun-hung / Attorney, Convenor of the Digital Law and Policy Group, JRF

Speaker: Chang Ching-ju / Attorney, Executive Committee Member, JRF

With the evolution of digital technology, traditional "physical investigations" are gradually being replaced by highly efficient and covert "technological investigations." The Judicial Reform Foundation recently held a special lecture moderated by attorney Chiu Tzu-ting, inviting attorneys Lin Chun-hung and Chang Ching-ju to deeply analyze the legislative history of Taiwan's draft Technology Investigation and Safeguards Act and its incorporation into the "Special Chapter on Compulsory Measures" of the Code of Criminal Procedure in 2024, while issuing warnings against the risks of digital rights infringements.

Starting from the GPS Controversy: The Warning of the Mosaic Theory

The lecture recalled that the issue of legalizing technological investigations originated from a 2017 GPS surveillance judgment by the Supreme Court. That judgment introduced the "Mosaic Theory": a single, fragmented piece of location information may not constitute an invasion of privacy, but when massive, long-term sporadic pieces of information are pieced together, they can fully reveal a person's life profile, social trajectory, and personal preferences.

Attorney Lin pointed out that technological investigations are characterized by being "fast, cheap, massive, and long-term," and possess a high degree of covertness. The monitored subjects are often entirely unaware when their information is extracted, which is vastly different from traditional searches that must be executed on-site.

Legislative Turning Point: Returning from a "Special Act" to the Code of Criminal Procedure

The draft Technology Investigation and Safeguards Act was initially promoted as dedicated legislation by the Ministry of Justice, but faced obstacles due to criticisms that it granted excessive administrative powers with weak oversight mechanisms. Ultimately, the version passed by the Executive Yuan in 2024 chose to incorporate its core methods into a dedicated chapter of the Code of Criminal Procedure.

The currently passed technological methods primarily include three categories:

1. GPS Location Investigation: Tracking carriers such as vehicles or vessels.
   
2. IMSI Catcher Investigation: Using simulated base stations to collect IMSI identifiers of mobile phones within a specific area for triangulation.
   
3. Monitoring Private Spaces from Non-Private Spaces: Using drones, high-magnification cameras, or thermal imagers to monitor private domains (such as the interior of a residence) from public places.
   

Device-End Surveillance and "Trojan Horse" Concerns

The lecture discussed the most controversial "device-end communications surveillance" (i.e., implanting Trojan horse programs). Although law enforcement agencies once argued that there were "small Trojan horses" that only monitored communication software, Attorney Lin noted after consulting experts that in the world of computer privileges, there is no distinction between "large and small." Once access is granted to implant a program, it means the state can control all photos, cloud data, and digital footprints within a mobile phone, equivalent to possessing a "master key" that unlocks an individual's digital life.

In addition, the lecture shared a recent practical case: police used surveillance cameras to zoom in and capture passwords entered by a defendant while operating a laptop in a public place, thereby cracking all of their digitally encrypted devices. This move has sparked concerns over whether people still retain the boundaries of privacy in physical and digital spaces under the "age of mass surveillance."

Gaps in Digital Rights and Recommendations for the Future

Faced with the collection of massive data, the lecture emphasized the importance of "data destruction" and "third-party screening mechanisms." Attorney Lin suggested that a neutral third-party funding unit should be established to be responsible for the custody and screening of information, ensuring that investigative authorities can only obtain "the minimum and necessary" data and supervising subsequent destruction procedures, rather than allowing data to remain indefinitely in the hands of the state.

Finally, the JRF actively advocates for the enactment of a Digital Rights Basic Act. Attorneys Lin and Chang jointly pointed out that traditional constitutional definitions of "autonomy and property rights" are no longer sufficient to address the digital age. Society should redefine digital human rights, including:

• Digital Autonomy: People should be able to choose not to be digitized, retaining the "right to be offline" and the right to use cash transactions.
  
• Principle of Data Minimization: Restricting the excessive collection and utilization of data by the state and corporations.
  

Conclusion: Although technological investigations are sharp tools for combating new types of crime such as fraud, if they lack restrained procedural norms and the principle of judicial reservation, they risk plunging society into a "boiling frog" style loss of rights. In a rule-of-law society, the advancement of investigations should be premised on safeguarding the fundamental rights of the people, rather than placing "convenience of investigation" above "privacy protection."