Ostro Ruling: why Sky-ECC encrypted chats are inadmissible

1. The facts

   The case originates from the Ostro-Amaranto operation, conducted by the DDA of Catanzaro against alleged members of the Gallace clan, accused of international drug trafficking and mafia association. According to media reports, the prosecution's case rested on thousands of decrypted messages from the Sky-ECC platform, acquired by French authorities and transmitted to Italy via European Investigation Order. In October, during the preliminary hearing under abbreviated trial, the GUP of Catanzaro declared such evidence inadmissible. The defense successfully argued that the digital evidence had been acquired opaquely, as French authorities invoked state secrecy over the technical methods and algorithms used to break the encryption. Without the possibility for defense experts to verify data integrity and the absence of manipulation, the judge ruled the right of defense compromised, resulting in multiple acquittals due to insufficient alternative evidence.

2. 

   The rules in play

   1. Art. 191 c.p.p. (Inadmissibility): sanctions the use of evidence acquired in violation of legal prohibitions.
   2. Directive 2014/41/EU and Legislative Decree 108/2017: legal basis for the European Investigation Order, requiring respect for fundamental rights in cross-border acquisitions.
   3. Art. 24 Constitution: guarantees the inviolability of the right of defense, violated by the inability to verify decrypted evidence and the algorithms used.
   4. Art. 270 c.p.p. (by analogy): rule invoked to limit the use of massively acquired data in proceedings other than the original ones without proper authorizations.
   5. Art. 111 Constitution (Fair Trial): establishes the principle of cross-examination between the parties and transparency in the formation of evidence.

3. What case law says

   Supreme Court case law has long fluctuated on the nature of encrypted chats. The Joint Sections initially suggested that such data could be considered documents, making them easier to acquire than traditional wiretaps. However, European case law has progressively clarified that the defendant must be able to exercise effective control over the legitimacy of the evidence. The orientation emerging from the Ostro case reinforces the idea that technical secrecy invoked by a foreign state creates an unbridgeable vulnus: if the algorithm is a black box, there is no guarantee of authenticity. More recent merit jurisprudence tends to sanction the opacity of the decryption procedure, prioritizing the defendant's right to appoint a technical expert to verify the absence of false positives or profile attribution errors.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Timely objection: it is crucial to object to the inadmissibility of foreign digital data as early as the preliminary hearing, focusing on the algorithm's lack of transparency.
   2. Technical cross-examination: appointing a computer expert is essential to technically demonstrate why decrypted data without access to encryption keys is not verifiable.
   3. Regulatory differentiation: always distinguish between the physical acquisition of a computer device (already covered by different case law) and the acquisition of remotely decrypted telematics flows, which require distinct procedural safeguards.
   4. Custody chain control: meticulously check every step of the data transmission from foreign to Italian authorities to identify any formal defects in the EIO.

References: Articolo 191 Codice di Procedura PenaleArticolo 24 Costituzione ItalianaArticolo 111 Costituzione ItalianaArticolo 270 Codice di Procedura PenaleD.Lgs. 108/2017Direttiva 2014/41/UEArticolo 6 CEDUArtt. 266 e 266-bis c.p.p. (esclusi)Art. 234-bis c.p.p. (escluso)Art. 270 c.p.p. (per analogia)D.Lgs. 108/2017Art. 24 CostituzioneDirettiva 2014/41/UEArticolo 191 Codice di Procedura PenaleArticolo 111 Costituzione ItalianaArticolo 6 CEDUArticolo 270 Codice di Procedura PenaleD.Lgs. 108/2017Direttiva 2014/41/UEArticolo 24 Costituzione ItalianaArticolo 111 Costituzione ItalianaArticolo 6 CEDUArticolo 191 Codice di Procedura PenaleD.Lgs. 108/2017Articolo 270 Codice di Procedura PenaleArticolo 24 Costituzione ItalianaDirettiva 2014/41/UEArticolo 111 Costituzione ItalianaArticolo 6 CEDUArticolo 191 Codice di Procedura PenaleArticolo 24 Costituzione ItalianaArticolo 111 Costituzione ItalianaArticolo 270 Codice di Procedura PenaleD.Lgs. 108/2017Direttiva 2014/41/UEArticolo 6 CEDU

Editorial oversight: Avv. Federico Papa·ICAMUpdated 17 October 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction