Must a person disclose a phone passcode during a search in Ukraine?
Short answer
The Criminal Procedure Code does not impose a general duty to disclose a passcode to an investigator or prosecutor. Article 236 expressly anticipates refusal to deactivate logical protection and permits investigators to overcome it themselves. Do not physically obstruct the search: invoke the privilege against self-incrimination, request counsel, and require the refusal and every action involving the phone to be recorded in the protocol.
- Published
- Legally reviewed
- Author
- Vitaliy BessonovAttorney-at-law, license No. 1893 dated 18 February 2015
Step-by-step action plan
- 1Ask for counsel to be admitted immediately; do not touch the device, erase data or physically resist
- 2State calmly that you will not disclose a passcode before consulting counsel and invoke Article 63 of the Constitution and Article 18 CPC
- 3Ask who requests the code, the procedural basis, the specific device and proposed action; require the request, response and rights warning to appear on the official recording
- 4Monitor and request protocol entries for every phone action: lock state, attempt count, specialist, technical tools, areas opened, copying and packaging
- 5Before signing, dictate precise comments without legal exaggeration, verify the device description and obtain the second protocol copy with its attachments
What the law provides
Article 63 of the Constitution of Ukraine provides that a person is not liable for refusing to give testimony or explanations about themselves, family members or close relatives. This is a constitutional safeguard against self-incrimination, not permission to obstruct a lawful investigative action or destroy information.
Article 18 of the Criminal Procedure Code prohibits compelling a person to admit guilt or provide explanations or testimony that may support suspicion or accusation. Every person may say nothing concerning a suspicion or accusation against them, refuse to answer questions, and must be informed of those rights immediately.
Article 236(6) CPC separately addresses the technical situation during execution of a search warrant. If a person present refuses to open a locked item or remove or deactivate logical protection, the investigator or prosecutor may overcome that protection. The current CPC therefore does not create a separate duty to state a passcode: it expressly anticipates refusal and defines the investigators’ authority after it.
This does not mean that access to every phone in every situation is lawful. The warrant’s scope, purpose and extent of the search, the officers’ authority, how the device was obtained, the access sequence and the recording of computer data all require review. Under Article 236, counsel must be admitted at any stage of the search; persons present may make statements for the protocol, receive a second copy with the seizure inventory, and a residential search must be audio- and video-recorded.
What follows from case law
In its judgment of 4 June 2025 in case No. 686/20198/22, proceeding No. 51-565km25, the Third Chamber of the Criminal Cassation Court considered data from a phone taken during a lawfully conducted personal search after detention. The phone had been treated as physical evidence and seized by court order; an investigating judge refused temporary access, after which the investigator inspected information on the device.
The Court rejected the absence-of-consent argument because the convicted person stated during trial that he had voluntarily given law enforcement the access codes. It treated that established fact as consent to data access and stated that a separate judicial inspection order was unnecessary where the holder voluntarily consented.
The conclusion does not impose a duty to disclose a passcode or make every unlocking voluntary. It is limited to the established voluntary supply of codes, lawful possession of the phone and that case’s procedural history. The judgment also did not separately decide compelled Face ID or fingerprint unlocking.
Step-by-step action plan
Common mistakes
What to check after the search
Preserve the warrant copy, protocol, inventory, complete available recording and your timeline. With counsel, compare the warrant’s scope, how the phone was obtained, consent or refusal concerning the code, actions taken against logical protection, data copying and the later inspection protocol. The procedural assessment depends on all those materials, not on one statement about a passcode.
Rule of law and case law
What the law provides
- Constitution of Ukraine — ст. 63
- Criminal Procedure Code of Ukraine — ст. 18, 236
What follows from case law
In case No. 686/20198/22, the Court relied on the convicted person’s statement that he had voluntarily given law enforcement the access codes and treated that act as consent to data access. The judgment does not establish a general duty to disclose a passcode or decide compelled disclosure.
Official sources
- LawConstitution of Ukraine — ст. 63
- LawCriminal Procedure Code of Ukraine — ст. 18, 236
- Supreme CourtSupreme Court Third Chamber, 4 June 2025, case No. 686/20198/22 — voluntary provision of access codes
- Supreme CourtSupreme Court Third Chamber judgment of 4 June 2025 in case No. 686/20198/22, proceeding No. 51-565km25
- Supreme CourtOfficial Supreme Court review for the first half of 2025 — case No. 686/20198/22
- RegistryUnified State Register of Court Decisions
- RegistrySupreme Court Legal Positions Database
Frequently asked questions
Does the CPC require a person to state a phone passcode?
The CPC does not impose a separate duty to state a passcode. Article 236(6) expressly anticipates refusal to open an item or deactivate logical protection and permits the investigator or prosecutor to overcome it. Refusal does not permit physical obstruction or data destruction.
May an investigator overcome the device lock?
Yes. During execution of a search, Article 236(6) CPC permits an investigator or prosecutor to overcome logical protection where a person present refuses to deactivate it or the relevant persons are absent. The warrant, protocol, recording and circumstances determine the lawfulness of the particular access.
Does refusal automatically make phone data inadmissible?
No automatic consequence follows. A court examines lawful possession of the phone, the warrant’s scope, how protection was overcome, access recording, data integrity and the effect of any violation. Refusal alone does not decide admissibility.
What if the code has already been disclosed?
Do not rewrite the event retrospectively. Record who requested the code and when, which rights were explained, whether counsel was present, whether threats or promises were made, and what was opened or copied. Counsel should compare those facts with the full recording, protocol and later data inspection.
Are a passcode, Face ID and a fingerprint legally identical?
The CPC does not separately prescribe consequences for each unlocking method, and case No. 686/20198/22 concerned voluntarily supplied codes. A conclusion about passcodes should therefore not be automatically extended to compelled biometrics; the specific act should be recorded and assessed with counsel.