Role of Service Providers in Cybercrime Investigations Professor Ian Walden Centre for Commercial Law Studies, Queen Mary, University of London

Service providers Cybercrime Convention: ‘service providers’ “any public or private entity that provides to users of its service the ability to communicate by means of a computer system, and any other entity that processes or stores computer data on behalf of such communication service or users of such service.” Explanatory Report ‘a broad category of persons’: From mobile operators to WhatsApp Free or paid; public or private provision Not a mere provider of content, with no “communication or related data processing services”

Service Provider Data Content Traffic data Subscriber data ‘In transmission’ (lawful intercept) and ‘at rest’ (production orders) “within its existing technical capability” or build ‘intercept capability’? Traffic data Cybercrime Convention, art. 1(d) “any computer data relating to a communication by means of a computer system, generated by a computer system that formed a part in the chain of communication, indicating the communication’s origin, destination, route, time, date, size, duration, or type of underlying service.” Subscriber data

Data Availability Historic Current Future Data Retention Directive 06/24/EC Fixed & mobile telephony, internet access, email & telephony: Communication data not content 6-24 months Current ‘expedited preservation’: ‘quick freeze’ (arts. 16-17) Future Real time collection of traffic data (art. 20) Art. 14(3) Limitation if a ‘closed group of users’ or non-public network and not connected

Obtaining data Mandatory (national) Production order (art. 18) Person ‘in its territory’ or service provider ‘offering its services in the territory’ with ‘possession or control’ Search and seizure (art. 19) Extending the search to networked computer systems Protected data (art. 19(4)) Voluntary (national & international) “obtains the lawful and voluntary consent of the person who has lawful authority to disclose” (art. 32)

Co-operation Council of Europe Guidelines (2008) Common measures Building long term, formalised relationships e.g. Single Points of Contact Need for cost reimbursement or fair compensation Law enforcement measures Requests carried out in accordance with agreed procedures Service provider measures Emergency procedures for urgent circumstances Promoting a ‘culture of co-operation’ Safeguarding fundamental human rights Impact of Snowden revelations?