Green light for the "State Trojan": goodbye to privacy in Italy

The Italian Parliament has definitively approved the law introducing the so-called state "trojan," a powerful digital surveillance tool. With the vote on June 14th, the reform of the penal code and the code of criminal procedure authorizes judicial authorities to install "computer interceptors" on citizens' electronic devices.

The measure, which has reportedly been largely ignored by the general public, will become operational after publication in the Official Gazette and a 30-day vacatio legis. From that moment, a joint ministerial commission appointed by Justice Minister Andrea Orlando will have three months to regulate in detail the use of these interception tools.

The new law regulates the activation of device microphones only upon explicit command, with the Judicial Police required to record the start and end times of recordings. However, the list of crimes for which the use of the trojan is permitted appears very broad and confusing, encompassing not only serious crimes but also offenses such as threats, insider trading, and telephone harassment.

The debate over so-called state "trojans"—legitimate spyware used by judicial authorities—originated in Italy with Legislative Decree No. 216 of December 29, 2017. This legislation, enacted to implement Delegated Law 103/2017 (known as the "Orlando Reform"), introduced a comprehensive framework in the Code of Criminal Procedure for the use of "computer interceptors." The tool, which can be covertly installed on smartphones or computers with judicial authorization, allows not only calls but the entire digital content of a device to be intercepted, immediately raising questions about the balance between investigative needs and privacy protection.

The law restricts its use to investigations into particularly serious crimes, such as organized crime, terrorism, and corruption, requiring specific authorization from the Judge for Preliminary Investigations. In subsequent years, the framework has been amended by other measures, such as the 2022 Cartabia reform and the so-called "Nordio Decree," fueling ongoing political and legal debate. The Court of Cassation has ruled in several decisions that the tool does not inherently violate confidentiality in a disproportionate manner, provided procedural safeguards are respected.