1. Role of Service Providers in Cybercrime Investigations
Professor Ian Walden
Centre for Commercial Law Studies, Queen Mary, University of London

2. Service providers Cybercrime Convention: ‘service providers’
“any public or private entity that provides to users of its service the ability to communicate by means of a computer system, and
any other entity that processes or stores computer data on behalf of such communication service or users of such service.”
Explanatory Report
‘a broad category of persons’: From mobile operators to WhatsApp
Free or paid; public or private provision
Not a mere provider of content, with no “communication or related data processing services”

3. Service Provider Data Content Traffic data Subscriber data
‘In transmission’ (lawful intercept) and ‘at rest’ (production orders)
“within its existing technical capability” or build ‘intercept capability’?
Traffic data
Cybercrime Convention, art. 1(d)
“any computer data relating to a communication by means of a computer system, generated by a computer system that formed a part in the chain of communication, indicating the communication’s origin, destination, route, time, date, size, duration, or type of underlying service.”
Subscriber data

4. Data Availability Historic Current Future
Data Retention Directive 06/24/EC
Fixed & mobile telephony, internet access, & telephony: Communication data not content
6-24 months
Current
‘expedited preservation’: ‘quick freeze’ (arts )
Future
Real time collection of traffic data (art. 20)
Art. 14(3) Limitation if a ‘closed group of users’ or non-public network and not connected

5. Obtaining data Mandatory (national)
Production order (art. 18)
Person ‘in its territory’ or service provider ‘offering its services in the territory’ with ‘possession or control’
Search and seizure (art. 19)
Extending the search to networked computer systems
Protected data (art. 19(4))
Voluntary (national & international)
“obtains the lawful and voluntary consent of the person who has lawful authority to disclose” (art. 32)

6. Co-operation Council of Europe Guidelines (2008)
Common measures
Building long term, formalised relationships
e.g. Single Points of Contact
Need for cost reimbursement or fair compensation
Law enforcement measures
Requests carried out in accordance with agreed procedures
Service provider measures
Emergency procedures for urgent circumstances
Promoting a ‘culture of co-operation’
Safeguarding fundamental human rights
Impact of Snowden revelations?