The Civil Guard buys a system for 2.5 million to access the mobile phones of people who may have key information in an investigation.

The Civil Guard formalized a contract for a system to perform remote recordings on mobile phones and other IT devices, valued at over two million euros. This system involves deploying software on Android and iOS terminals to access stored content and communications from these devices. The contract defines the supply as a recording and deployment system intended for remote IT recordings of mobile devices within the LECrim framework. Details regarding the commercial model, technical capabilities, or the specific information accessible are not specified. The acquisition was awarded via a negotiated procedure without public advertisement, based on justification related to exclusive rights due to a single supplier in the Madrid region. Spanish law requires judicial authorization for remote access to IT equipment during criminal investigations and mandates necessity and relevance.

The process highlights a tension between operational necessity and the stringent legal and privacy safeguards surrounding technological investigation. The award procedure, relying on justification for exclusive rights rather than public competition, points toward an administrative decision prioritizing efficiency over open bidding, which warrants scrutiny regarding due process in public procurement. Furthermore, the vagueness surrounding the system's technical specifications—specifically what constitutes "transparent access" and the scope of data access (real-time vs. stored)—creates a significant information vacuum. This ambiguity functions as a form of regulatory insulation, allowing an operation that inherently touches upon sensitive digital rights to proceed without fully defining the extent of surveillance capabilities upfront. The requirement for judicial authorization in Spanish law underscores that while technology permits remote access, the legal framework demands a high threshold of necessity and relevance for intrusion into personal data. The pattern suggests a reliance on operational expediency—justifying the negotiated procedure by citing supplier exclusivity—to bypass public transparency, setting up an environment where the scope of eventual use is determined post-contract rather than established ex ante. What frameworks are in place to ensure that "transparent access" translates into legally enforceable boundaries for data collection and retention during judicial oversight?