> I’m assuming that the stolen information doesn’t have this limitation

Stolen information has provenance problems that make it difficult to use as evidence of any crime other than theft itself in any system with even rudimentary due process protections and presumption of innocence.

I mean, it's hardly as if you are going to be able to get the people who handled the data between the people who had it lawfully and the time it got to the police on the stand to attest to it's integrity.

(That doesn't prevent its use in investigations, but it means that it would only lead to convictions in a contested case where the police used it to locate proof that was legally sufficient without the use of the DNA as evidence.)

Law enforcement is trained in information laundering and courts consider it a legitimate tactic.

Its easy to use this information to search for suspects, but not bring it up in court once you find other evidence.

https://en.wikipedia.org/wiki/Parallel_construction

Most law enforcement typically use a handful of commercial agencies (like Parabon NanoLabs, etc) for these kind of searches, it seems highly unlikely that any of them would risk using illegally obtained data because it would put their entire business at risk.

(obviously if your threat model includes intelligence agencies, etc. then your calculus might be different)

Honestly all I see is upside for the business.

And of course law enforcement has never before used illegally obtained evidence to construct a new trail that was plausible:

https://en.wikipedia.org/wiki/Parallel_construction

It's not about law enforcement using the data, it's about the viability of running a business that provides illegal hacking services for law enforcement.

Works for Hacking Team and NSO.

I’m cackling at the idea of GDPR compliant data thieves. “This data is only to be used for the purposes of: anything. The data controller is: whoever.”