12 minute read
Is your phone being tapped? Covert surveillance in Ukraine in plain words, and what the defence can really do
People talk about covert investigative actions either in a whisper or with confidence that "the latest iPhone can't be cracked". Both positions are wrong. Interception, data collection and tracking are a procedure with a court ruling, time limits and an obligation to notify you once it is over. And a phone gives away most information not because it was "hacked", but because the information was never in the phone in the first place.
Your private communications may be interfered with only under a ruling of an investigating judge of a court of appeal, and only in cases concerning serious and especially serious offences. The ruling is valid for up to two months. You must be notified of the covert actions within 12 months after they end. iPhone encryption protects the content of messages in the phone itself — but not call records, not cell-tower location and not the iCloud backup.
What covert investigative actions are, and why nobody knows about them until it is all over
Covert investigative (search) actions are investigative actions "information about the fact and methods of which is not subject to disclosure". In other words, they are not a separate kind of off-the-books operational work, but part of the same pre-trial investigation — with records that later go into the case file and that the defence is entitled to receive.
The law sets two conditions at once. First, the information about the offence and the person "cannot be obtained in any other way". Second, most covert actions that concern a phone are permitted only in proceedings on serious or especially serious offences. Theft or a domestic disturbance does not qualify for interception; drug dealing under Article 307, bribery, unauthorised absence under Article 407 and large-scale fraud do.
The scale is not small. In 2024 investigating judges considered 151,000 applications for permission to carry out covert actions and granted 138,000 — 91 per cent. These are not the "exceptional cases" the law speaks of; this is routine in cases about serious offences.
What exactly can be done with a phone
The Code does not use the word "tapping". It has four kinds of interference with private communications and several other covert actions that concern a phone indirectly. Each comes with its own ruling and its own limits.
Interception of information on electronic communication networks
This is what is commonly called tapping: monitoring, selecting and recording the content of information passing through the operator. The ruling must contain the details that make it possible to "uniquely identify the subscriber under surveillance, the electronic communication network and the terminal equipment" — a number, an IMEI, an account. The operator must assist and has no right to tell the subscriber. The defence here has one tool: a ruling for a specific number does not allow listening to another one, and every record is later checked against the limits of the ruling.
Collection of data from electronic information systems
Access to the device itself or to an account without the owner's knowledge requires a ruling. But this article has a second part worth knowing word for word: no permission is needed to obtain information from a system "access to which is not restricted by its owner… or is not connected with overcoming a logical protection system". Put simply: a phone without a passcode, an open social media profile, a public channel — none of this is interference. That is exactly how the Supreme Court reads it: switching on an unlocked phone and looking through its SMS is not a covert action.
Locating radio equipment
Where the phone is — by base stations, "without disclosing the content of messages". This is the only phone-related covert action that, in exceptional urgent cases — saving a life, preventing a serious offence — may be started before a ruling, with an immediate application to the court once it has begun. If the judge refuses, the action stops and whatever was obtained is destroyed.
Audio and video monitoring of a person or a place
A microphone and a camera working near you — in a car, an office, a flat — under a ruling. To install the equipment, the law allows covert entry into places not open to the public. This is not a "hacked phone", but the result is the same: the conversation is recorded.
The myth of the iPhone that can't be cracked
People imagine a single threat — someone has remotely "hacked" the phone and is reading the messengers. In reality an investigation works with three layers, and in two of them the phone is not needed at all.
Layer one: the operator
End-to-end encryption in Signal, WhatsApp or iMessage protects the content of messages. It does not hide that you communicated, when, for how long and where you were at the time. The operator always sees this, and determines location by base stations to within a city block — and there is no hiding from it while the phone is on. For an investigation this is the cheapest layer: a ruling on interception or temporary access to call records gives a picture of a person's life without touching the device at all.
Layer two: the cloud
This is where the myth lives. With standard settings, an iPhone's iCloud backup is encrypted with keys stored in Apple's data centres — and that backup includes the key to your iMessage. Apple says so plainly in its documentation. So a request to Apple through international cooperation gives access to messages without hacking the device at all. End-to-end protection of the cloud appears only once Advanced Data Protection is turned on — and even then iCloud mail, contacts and calendar are not end-to-end encrypted. The same goes for Telegram "cloud" chats or WhatsApp backups to Google Drive without separate encryption.
Layer three: the device itself
This is where the iPhone really is strong — but with conditions. The encryption keys for some of the data are wiped from memory only in the "before first unlock" state after a restart (BFU). A phone that has been unlocked at least once since it was switched on (AFU) keeps the keys in memory, and those are the phones forensic toolkits such as Cellebrite or GrayKey get into most often. According to leaks in 2024, current iOS versions in the BFU state are closed to them; older versions and the AFU state are not. Since iOS 18.1 an iPhone restarts itself after 72 hours without being unlocked — precisely to return to the protected state. Such toolkits exist in Ukraine: Cellebrite purchases for law enforcement went through Prozorro in 2019–2025.
"An iPhone can't be cracked" is true only of the third layer, only for a current iOS, and only for a phone that is switched off or has been restarted. The first two layers are open under a ruling with no hacking at all. And Pegasus-class spyware gets around the third as well — except in Lockdown Mode, which has not been broken so far.
Arrest: the phone in the investigator's hands
This is the most common situation, and it is not about covert actions at all. The phone ends up in police hands on arrest or during a search, and there is one question — may they look at it and demand the passcode.
On passcodes and Face ID
The right not to testify against yourself means you are not obliged to give your passcode, and there is no liability for staying silent. What the investigator does next is up to them: the law allows them to bypass protection during a search, but they do it, not you. Biometrics is a separate question: there is as yet no case law expressly prohibiting holding the phone up to your face. The practical conclusion is simple: a passcode is stronger than Face ID, and a phone that is switched off is stronger than both.
They may not seize it "just because" — and they always do
The law is on your side here, and it is worth knowing word for word. Temporary seizure of mobile terminals, computers and other electronic systems is prohibited — except in three cases: the phone is needed together with the information for an expert examination, it is an instrument or a product of the offence, or the owner has restricted access to the data and it cannot be copied on the spot. In all other cases the investigator must not take the device but make a copy of the information with the help of a specialist — at your request, onto your own storage device.
In practice, a phone is seized at every arrest and almost every search. The explanation is always the same — "there is logical protection, copying is impossible" — and formally it falls under the third exception. Arguing on the spot is pointless; something else works. Property taken without a ruling is temporarily seized, and the investigator or prosecutor must apply to an investigating judge for an attachment order no later than the next working day, otherwise the phone has to be returned immediately. The attachment application is heard with your participation — and that is the first moment when the defence can show that none of the three exceptions has been proven and the phone has nothing to do with the events. If the attachment is ordered after all, there is a separate application for return, and a complaint to the investigating judge about the investigator's or prosecutor's failure to return it.
What to do at the moment of seizure
What the defence can do: three points of entry
Covert actions are carried out without you, but they are assessed with you. And it is here that the results of interception can stop being evidence.
Point one: disclosure of materials
The prosecution must disclose to the defence not only the records of the covert actions but also the documents on which they were based — applications, decisions, rulings. The Grand Chamber of the Supreme Court said so directly: the defence "is entitled to information about all elements of the procedure by which the prosecution obtained evidence". If they were not disclosed, the court may not use them. If the ruling was not declassified for reasons beyond the prosecutor's control, it is disclosed later, and the court must give the defence real time to contest it.
Point two: the limits of the ruling
A ruling covers a specific person, a specific number, a specific period and a specific offence. Anything outside that is inadmissible as obtained without the court's permission. They were listening to one person but are charging another whose voice was "accidentally" recorded? A separate ruling on using the results in other proceedings is required — otherwise an acquittal, and the Supreme Court has upheld such acquittals. Recording after the two months had expired? Audio monitoring in a detention centre without a ruling, citing urgency? All of these are material violations under Article 87 CPC, and together with the evidence everything derived from it falls too.
Point three: entrapment
Controlling the commission of an offence — a controlled purchase, a special investigative experiment — has a hard limit: "it is prohibited to provoke (incite) a person". If there was no objective suspicion before the covert actions, if permission was obtained before the crime report appeared, if the "buyer" is a regular police informant — that is entrapment by the criteria of the European Court of Human Rights, and it is the prosecutor, not you, who must prove there was none.
In 2022 the Supreme Court softened its approach: a procedural violation leads to inadmissibility not automatically, but if it affected a constitutional or Convention right. So the defence is built not on "finding a mistake in a date", but on proving that this particular mistake violated your right to privacy or to a fair trial.
What not to do
- "Clean" the phone after being summoned by the investigator. The law has no separate criminal offence for destroying your own data. But the investigation will find out — and the court will weigh that conduct. More importantly: along with the "dangerous" material you will destroy what could have supported your version.
- Trust "disappearing messages". They disappear for the other person too — but not from their backup or from the operator.
- Discuss the case on the phone once proceedings are open. If you are suspected of a serious offence, assume the ruling already exists. Communication with your lawyer is protected separately: interference with it is expressly prohibited.
- Hand over the passcode "so they let you go faster". They will not let you go faster. And whatever they find will go into the charges.
What is worth doing today
- A passcode instead of Face ID as the main way to unlock; a long alphanumeric one, not six digits.
- Turn on Advanced Data Protection for iCloud — or switch off cloud backup altogether.
- Keep iOS updated: older versions are open to forensic toolkits.
- If the risk is real — Lockdown Mode. Inconvenient, but not broken so far.
- Remember that a phone that is switched off is the only state in which the third layer is truly closed. The first two are never closed.
Frequently asked questions
Can I find out whether my phone is being tapped?
No — neither technically nor by request. The operator is obliged to stay silent. The only lawful route is the notice after the covert actions end, which the investigator or prosecutor must send within 12 months, and the case materials disclosed to the defence under Article 290 CPC.
Can they tap a phone over a theft or a road accident?
No. Interception on networks and systems, audio monitoring and surveillance are allowed only in proceedings on serious and especially serious offences. Locating a phone under Article 268 is not named on that list — its limit is different: only when the information cannot be obtained otherwise.
Am I obliged to give my phone passcode?
No. This is the right not to testify against yourself under Article 63 of the Constitution and Article 18 CPC. During a search the investigator may bypass protection themselves — but without your participation.
Does Telegram or Signal protect against tapping?
The content — yes, if it is a secret chat or end-to-end encryption. The fact of communication, the time, the place and cloud copies — no. In ordinary Telegram chats the history is stored on Telegram's servers.
What if I was tapped without a ruling?
Raise the inadmissibility of the evidence under Article 87 CPC — and of everything derived from it. Supreme Court case law is on the defence's side where the right to privacy itself was violated: covert actions without a ruling, outside its term, or against another person without separate permission.
In short
Tapping means a ruling of an investigating judge of a court of appeal, for two months, in a case about a serious offence — and you will be told about it after it ends. An iPhone protects only what is in the phone itself, and only while it is switched off; the operator and the cloud are open under a ruling with no hacking. You are not obliged to give your passcode to anyone. Seizing a phone without grounds is prohibited — but it is always done, and getting it back goes through the investigating judge. The results of covert actions stop being evidence when the prosecution did not disclose the documents they were based on, went beyond the limits of the ruling or provoked the offence — and that is what the defence fights for.
Your phone was seized, or you suspect it is being tapped?
Tell us which proceedings and what has already happened — we will look at which materials the prosecution must disclose and what in them can be challenged.