Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3207 Thanks!
[Music]
all
right yeah count take a seat our next
speaker is Claus leld who due to his
profound expertise in the IT industry
and Tech regulation is a wanted advice
on various International committees
among a range of roles he is the vice
chair of the management Board of Eco
Association of the internet industry
Claus was also part of the official
implementation task force of the
so-called aue evidence regulation which
was proposed in 2017 and completed this
year since then the law mandates
crossborder access to all sorts of
stored information by law enforcement
but how is it going to be implemented
legally and technically and what about
potential gray areas Claus is here to
provide us an Insider view on these
questions and we hopefully also shed
some light on how individuals are
actually affected by this new regulation
and let's give him a warm welcome to the
stage CLA landerfield thank you very
much yeah and hello everybody thank you
very much for having me um
uh unfortunately this is not a repeat of
the
uh 36 C3 talk because um uh by now this
Beast has become regulation it's um it
has become part of EU regulation um and
what we're looking at or we will look at
right now short uh agenda I want to show
you what the evidence is about the
categories of data affected who is
addressed by the regulation when will it
end to force um how does a electronic
production order work and um the
problems identify legal challenges and
so on um so what is it about um the
evidence has become uh de facto law this
year with um the EU regulations uh
23543 and 1544 one is about the
electronic production order itself so
this is about um uh electronic evidence
in criminal matters let's be clear about
this this is all about criminal matters
so there needs to be some criminal
proceeding um by laww enforcement in one
EU member state in order for this to
take effect and um be applicable um and
um the other directive uh is about the
designation of a representative so
everyone who has to observe uh the um
the regulation will need to designate a
representative or a legal representative
basically where um a production orders
can be addressed too um so um it's not
entirely new the data concerned was um
available through multilateral
agreements before that means there was a
de facto procedure when one state could
re or law enforcement of one state could
request data from another state or
service providers in another state
through very lengthy paper process
basically it's it's been around for
decades um and it is very slow it's not
digitized this is about digitizing the
process um but unfortunately it has
become a very cumbersome way to to do
this um uh but as I said it was in
principle available before now the new
thing is that the authorities in the the
target state will only be partially
involved um uh in principle service
providers will send data or release data
directly to the inquiring law
enforcement agency from another EU
member state so this is all about within
the EU um but you will have to answer
not only to your local law enforcement
from now on but also for law enforcement
from other countries IES um uh what is
about the categories of data in
principle subscriber data so everything
identifying a user um uh not the traffic
and content data um the traffic and
content data itself will also be
available um but this is all about store
data so this is not about data in motion
this is not about tapping telephone
calls or um uh uh things like that or
intercepting email this is about store
data but that could be anything up until
whatever a whole instance so um any
source of data can be requested from law
enforcement from a service provider in
another EU country um however the there
is a limitation which basically says
there needs to be a criminal proceeding
of substantial crime um and the the way
they figured this out is that there
needs to be an at least threeyear
maximum custodial a minimum of a
threeyear maximum custodial sentence so
the offense needs to have a a sentence
which is at least 3 years or more in
order to be applicable for this but
immediately there was an exception um
the exception u meaning where where it
is applicable even for crimes where
there's less than three years of a
sentence um this is cyber related
offenses where there's only electronic
evidence um which could be all sorts of
things nowadays um but also um uh things
which are minor offenses by itself but
it's it's uh been been done in a m
uh in in a uh Mass proceedings which
obviously could happen in the internet
could be um U ransomware attacks could
be could be spam could could be anything
could be fishing things like that um uh
and of course uh we always have that
terrorism related offenses and offenses
concerning sexual abuse and and sexual
exploitation of children but that has a
higher sentence anyway um uh who is
addressed so who will have to absorve
this um absorb this typical is provid of
electronic communication services that
is nothing new so everyone um uh doing
telepan doing email doing uh uh uh
instant messaging things like that um
and internet infrastructure Pro
infrastructure providers um which is uh
uh ripe for example everyone providing
IP addresses domain registers um things
like that um so this is nothing new but
there is something really new in there
which is Information Society service
providers um this is all sorts of El
ronic services on the internet um could
be anything it was limited with um two
Provisions which says um the there needs
to be some user service about storing
data or processing data or the users
need to be able to communicate with each
other um this is derived from uh from
from some other EU definition um I I
have it in here you don't really need to
concerned this is available for download
everything I included it for for um uh
completeness sake um um so what does it
mean it is really broadening the field
of service providers um so
telecommunication service providers
we've always had to do this we have to
do this for decades to deliver data to
law enforcement um but now um the these
these two provisions of communication
between users it could be anything could
be comments right so how can users of
your platform communicate with each
other um also what means uploading
content um I know a lot of um football
clubs things like that where you can
upload videos you can upload pictures
this is all data storage so all of them
are affected now um uh and uploading
data and some further processing could
be whatever picture processing Services
could be uh your heating system uh where
where data is uploaded all the time um
uh most prominently of course video
Services where your video camera is
storing data somewhere on a cloud
service or something like that this is
all part this is all affected by the
regulation so so every service provider
offering a service like this is now part
of the of the regulation so that means
even small and not for-profit
organizations need to concern themselves
with this new regulation there's no
exemptions provided for associations
clubs cloud services iot offside video
sword gaming Services whatever no
exceptions are in the text right now um
there's also no size caps in the text so
it doesn't matter if you have 10 users
or 100,000
users you're
affected um when will it enter into
Force so the technical definitions and
the implementation act and I'll talk
about this um a bit later there will be
have to be finished by October 20 2024
so in order to um so that the
implementation act which really says and
how will this be implemented what
interfaces what protocols will be used
to release the data um can be
implemented in the member states and by
the service providers um the actual
going live is on the 18th February of 26
um and the um transition end of the
transition period by then every service
provider will have to name a
representative on who to address um
requests to uh ends on the 18th of
August 26 so if you really consider that
you need to implement something and and
it needs to be coordinated
internationally this is not a very long
time it's actually a rather short
implementation time frame
um uh there is a provision in there
which which says that um designated
establishments or basically the the uh
uh technical entities interfacing with
law enforcement can be used um by by
several service providers um and that is
supposed to work for very small service
providers or medium-sized Enterprises
and I'll come back to that in the end
because I think that is uh that that
might be a hook where clubs and not
for-profits uh could work together um
statistic collection will also start in
August 26 because there's obviously a
review in there U which states that that
all the numbers how often will this be
used um uh is supposed to be fully
disclosed there should be statistics on
it and everything um how does an
electronic production order work um it's
um there is a issuing authority this is
basically law enforcement um or a court
in the um in a country where a crime was
committed there's a service provider
who's obliged to respond to to this
request by the issuing authority and
then there's something which called an
an enforcing Authority this is basically
an authority in this country where the
service provider is registered or where
the legal representative of the service
provider is registered in order well the
principal idea is that if the service
provider doesn't respond this Authority
because it's in the same country can
enforce that it is actually happening
that data will be released so that
there's legal means to actually uh make
this work but there's more uh um uh the
enforcing authorities has have
additional um uh tasks which they need
to do which is basic has to do with the
pro protection of the individuals um so
the production of the requested data
when you receive a request you have 10
days to respond to it in principle in
emergency cases if there's uh this is
about um a loss of life or a threat to
life um kidnappings whatever so really
emergency cases you have 8 hours to
respond so I'm not so sure how a not
for-profit or a very small organization
can ensure that uh uh 24/7 they can
respond within 8 hours it's not supposed
obviously this will only happen very
seldomly to smaller entities but who
knows um uh if terrorists or whatever
are using your service are using your
Club to exchange information upload
videos could be anything you you don't
know
um uh there's also something called a
European preservation order but that is
not that important right now but there
basically law enforcement can ask you if
they can't procure the right signatures
by a judge or something they can
basically ask you to save data for 60
days so that nothing gets deleted um
obviously you can't inform the person
this is about and um there's also
provisions of enforcement there's PQ
sanctions if you don't um if you don't
reply there could be cost reimbursement
if it's in the law of the requesting
country but this is uh really only um
relevant if uh you have huge volume and
if there's a lot of requests of that
type coming in um so there will be a
central directory of service providers
where service providers will register
with a central Authority so basically
everyone has to do this um and um uh it
could be a designated establishment
which is um an organization basically
doing this offering this as a service it
could be the service provider itself um
who's um who's connecting with the
authority
it could be just the legal
representative or some some um um some
legal office which is representing an an
outside of EU service provider you could
have several channels which will become
very important later on um so it doesn't
mean that you only have to have one
point of contact you could have a point
of contract in every country um and um
uh that is basically what happens it's a
bit unclear how uh
if law enforcement was obviously under
the Imp that you could just say okay
it's this company but um the providers
have already made clear that well it's
not that simple it could be this company
for email it could be this company for
um uh for telepan um so it's not just
one entity um so so we really need
something like a rooting database um uh
where services and and entities are
rooted through in order to address the
the proper service provider um so
there's possible regulation players
maybe this is um getting a bit too much
into depth right now considering the
time we have um uh in principle the
issuing authorities can go directly to
the designated establishment and request
data this is happening when there's
something called a national case in play
what this really means I'll tell you in
a second if there's an international
Case um everything needs to be validated
by um uh by a court or at least by a
prosecutor and then it can be sent to
the legal represent ative but then there
will also be a notification in parallel
to the enforcing Authority so if you
look at this as workflows the national
case um what what does that mean it
means that the crime committed and the
um the supposed uh perpetrator of the
crime uh are um are within the same
country or um at least considered to be
um uh citizens of the same country but
they might be using a service outside of
their country country so it's still
considered a national case everything
will still is in national jurisdiction
and um so there will be no notification
at all there's no notification supposed
to happen if that is really um uh
considered a national case and data it's
just data being requested um from a
service provider outside of the country
that might lead to some problems for
service providers considering that um
let's use the example of an email
address um you have um um they think or
legal law enforcement thinks that it's
someone who's um a national of of their
own country but this the person might
have registered with you with some other
address and you might consider this to
be a national of of the country where
the service provider is located um and
and there is no there is no conflict
resolution for that right now service
providers will have to raise an
objection and basically say well wait a
second this is not a national case we
need to make this an international Case
um but this is not um it's not part of
the process right now we're trying to
get this to become part of the process
um in the international Case this is
Will We Believe will be the standard
case and most of the inquiries will uh
will will have to use that um uh uh uh
have to use that scheme it basically
means um law enforcement requests data
from it will typically be a very large
service provider so think uh meta or or
Google or something like that um and
will be hundreds of thousands of cases
where this will be used um uh so there
there will be a notification to this
service provider in most cases located
in Ireland uh and there will be a
notification to the enforcing Authority
which will be the enforcing Authority
again in Ireland
um much fun for the Irish to actually
come up with an enforcing Authority
large enough to cope with all these
requests um but we'll see how that goes
um and if there is no grounds for
refusal if the enforcing Authority B
does not say no you can't deliver the
data then the service provider will have
to uh respond within 10 days
unfortunately um the time for the
enforcing authority to tell you that
there is no re grounds for refusal is
also 10 days so basically you'll always
whoever came up with that idea um but
that's how it is in the text meaning um
you basically have to wait till the last
second before you can send out any data
um because the time frames are the same
so you basically have to wait will there
be a a refusal raised by the enforcing
Authority and then you can send out data
um currently there are discussions if
there could be something like a positive
notification basically saying we don't
raise an objection and then you can send
the data beforehand because obviously um
law enforcement would like to have the
data quicker than 10 days but um that's
where we are right now in the
implementation um if there is a refusal
um what happens um the enforcing
Authority will first Contact the issuing
authority that's the Green Arrow going
from the right to the left and discuss
um the these grounds for refusal and
then they'll either amand the um the
order and to make it um processible or
um if they don't amend it and thefor
saying Authority will the provider no um
we refuse that we raise an objection and
then you don't send any data um again
the 10 days um it's uh uh it's it's it's
almost impossible to resolve that that
time uh that timing in there but um
that's the task which the implementation
um group is currently um considering or
looking at right now um what does it
mean for the protection of the
individuals I think that is really what
what is most interesting for this group
here um there can be grounds of refusal
based on I'd say the obvious stuff which
which is always easy to get into um into
regulation um so yes if the data
requested are protected by immunities
are privileges um meaning if it's uh a
lawyer a parliamentarian uh uh a priest
um but it could also be press um then
you're not supposed to deliver this data
this raises the interesting question who
actually knows this because service
providers typically don't know this um
uh and who will actually raise the
objection will it be the service
provider will the enforcing Authority
have to research this observe it that's
the big question right now um some
countries have already said no we're not
going going to research anything here we
um uh uh we will just wait if someone
else raises an objection um uh so other
grounds for refusal if if the execution
of the order would entail a manifest
breach of the basically Charter of Human
Rights or the EU Charter um uh also uh
very clear because if if uh if if the
release of data would validate uh if um
violate your human rights um you're not
releasing any data um again who will
raise that who will actually do the
legal checking and in these bits um uh
then also one thing is the execution
order would be contrary to nibis EDM
basically you can't have double uh uh
criminality and you can't be prosecuted
for for something twice if uh someone
would actually know that you've already
prosecuted for this crime wherever you
know that from um the service prider
most certainly won't know that so um
they will never raise that um and um
then uh there's this interesting
question if the crime this is about is
actually an offense in the law of the
enforcing State um which could maybe not
be the case maybe this is only um a
crime in the uh in the issuing country
and we have that cases we have whatever
um abortion in Poland we have um uh uh
the the pman case and so so basically um
uh uh building a a new government versus
your own government things like that
which are not a crime in other in other
countries but in Spain it is so and
there's any number of cases if you
really dive into it because there is no
harmonization of um of the criminal laws
to certain extent there is but um there
is no really harmonization of the
proceedings the criminal proceedings
between the countries this is vastly
different if if you really look at the
European
countries um uh there are some further
Protections in there which are
interesting if you really read it so the
service basically say um I cannot
validate the the um uh the authority
sending me this because the digital
certificate is not is not checkable um
that will become an interesting bit
because uh law enforcement has a huge
problem in signing these orders there um
we've negotiated in The Proposal so this
has in the trialogue it it became part
of this that um that every order needs
to be digitally signed but um who's
actually a competent Authority how that
works who can sign it how can that be
validated that this is something which
can be signed it's unclear right now um
uh and um also the service provider
could basically look at the timing and
say okay this is only valid becomes an
order when it is signed when it's
digitally signed but the um uh the
actual law enforcement Authority might
have um issued that order beforehand
there might be a time difference up to
several days depending on the country um
between um them actually writing up that
they want this data and someone actually
a judge or something signing the order
um there could be a time difference and
what happens with data which is
collected in that time frame which time
um uh is actually the relevant time
frame if you release data was that
already collected at that point in time
was it collected afterwards was it
collected before that is relevant uh
because you might be liable as a service
provider if you just release data which
is not covered by um by the um by the
epoch Eve um and also interestingly
enough there was a political um thing
which was negotiated in there which is
basically saying um uh if um if a state
the enforcing Authority um is is worried
that um the person might not have a fair
trial in the other country or there's um
uh there's deficiencies and the
independence of the ising states
judicary I we're talking within Europe
right so we're not obviously the states
are not sure that that there is due
process and there is there might be a
breach of a fair trial within Europe um
but okay still obviously we want to help
each other out to the point that we send
data um but okay so there political uh
possibili in there meaning the enforcing
authorities has a lot of options to
actually say no you don't deliver this
data but this it's a purely political
decision and it means you actually need
to look at the individual order and this
is not going to happen for the majority
of cases you need to have some lists
some flagging of a person's identity
where you basically say no for this
person we don't deliver data and the
enforcing Authority will actually raise
the objection themselves because the
service provider in this case can never
raise the objection um so the problems
for service providers there are some
problems um as well which is The 8 Hour
Emergency Response is possible for small
companies I don't think that any private
organization will be able to do this um
um there's also the uh the it basically
says if you if you uh act in good face
if you just release data you cannot be
prosecuted as a service provider but
then they put this in good face in there
but if you already know there is a
protection if you already know that you
can't actually can't release the data
because the person should be protected
or it's not criminal it's not it's not a
criminal offense in your country how can
you act in good faith um and so so you
you might open up yourself for
litigation if you actually but by the
user if you actually release the data um
still there significant pecuniary
penalties in there um so it's gdpr style
it might be 4% of your Global turnover
if you don't re if you don't respond to
um to requests so you basically have to
ensure that you do respond to requests
um and um
uh interesting enough you might receive
um requests because the requests are
only evaluated under the law of the
country which issues the request but um
there's a lot of stuff which is illegal
in certain countries um
uh and uh and legal in another country
in the in the processing of request um
for example um if you in Spain um uh law
enforcement could ask for whatever the
city of Madrid who was locked into the
cell phone network at at any point in
time but you could take the whole city
this is completely illegal in Germany
you could never make this request um and
then and there there's any number of
requests you can one can Envision which
is impossible uh to answer in in in one
nation nation state um but is legal in
another nation state or for example in
Italy um data is released just on the
telephone number you don't need to know
who the individual is in Germany you
only release data um based on the
individual you need to get a request
based on a person not on on the
telephone number how do you resolve that
um it would be illegal to answer the
request just based on the telephone
number release content or traffic data
we don't do that so and and and and so
there's a number of countries who have
higher protection standards uh
Netherlands uh Austria Germany so on and
there's a number of countries where you
basically release everything normally
and don't ask questions which is Spain
Italy and so on um it's very difficult
to Recon reconcile that um uh and the um
there are conflict of law scenarios
where basically you say well I can't
release that data because third party uh
laws prohibit me from doing that that's
for example a problem between Europe and
the US where you can't release data um
even so um you would have to release it
in in Germany but um Microsoft for
example would say no sorry but US law
prohibits me from from releasing that
data and that needs to be resolved so it
is part of of um U of the regulation but
only for third party
countries um effectiveness of
protections is that actually effective
um no it is not because the the setup of
your service provider is completely
relevant um if you're located in the
same country than your service provider
um you're en forcing Authority will
basically check if you have Protections
in your
country that's normal you could do that
and the enforcing Authority might be
able to check that you have protection
that you're a member of Parliament that
you're a lawyer priest whatever
journalist in your country um in the
other variant um basically the enforcing
Authority is someone else consider the
case in Ireland I I said if you what uh
uh law enforcement of country a requests
um data from Facebook and and the page
actually says hey I'm a I'm a
parliamentarian in Austria um so
Facebook would know hey there there are
protections there you we can't release
that data um right away that would be
the Austrian Parliament would have to be
agree that this data is released
um but the enforcing Authority in
Ireland would only check if that
person's protected in Ireland um so
meaning um the checks fail through um
the data will be released and
potentially even stored um uh because
depending on the local legislation in
some countries all evidence you GA will
have to be stored by law enforcement
even if the case is dismissed and you
say I don't I don't further process that
um so um it really depends on the setup
of your ISP if the ISP would actually
locate a register in all EU countries um
and root all cases just through the
nation state where the user is located
this problem would completely go away
but what does that mean that means that
there will be a lot of court cases
because the non-involvement of the
user's home country in this setup um it
was discussed in the past but it was
abolished in the trialog um so there was
a question of do we send out two
notifications one to the enforcing
authority of the service provider and
one to the user's home country but the
states didn't want to bother themselves
with that they basically it's too much
work we can't we can't do that um and
all we all we really want is that law
enforcement gets the data
period that's that's really what this
was about um so it is um it is an
upcoming problem and the EU cours will
have to concern themselves with normally
they check is there a difference um
between how users are treated yes though
there there will be a difference in how
users are treated so we believe that
this will not be upheld if challenged
but it will take several years for this
to go away or be amended in a way that
it is will become acceptable um there's
also something um an interesting
question you might never have left your
country you have a hacked account
somewhere um you never contracted with
someone outside of your country you
never left your country you never went
to the country which is litigating
against you um uh you might not even not
have committed a punishable offense in
that country or in your home country and
you there still might be a trial going
against you or at least an investigation
against you in that country which uh
which then also requested and get got
data from you um
that is um something which we normally
don't have normally you would have to go
to the country where the person is
located in order to litigate against
that person uh now with e evidence you
might actually have to find a lawyer in
that country and defend yourself against
that even you even so you never went
there um so what can still be done this
is a regulation which is in effect it is
there um the procedures as well as the
design of the central system where
everything is routed through and um uh
and and if if for example these things
like um will there be a positive
notification that is all determined next
year and everyone who is an affected
entity can go to their own countries
Ministries and basically say well we
need workable regulation so they can
still push um in the implementation
process that this will become workable
procedures and and systems so there are
things trivial questions sometimes where
you say well
what happens if the enforcing Authority
is completely overwhelmed take the case
of Ireland so and and they don't respond
within 10 days will the service provider
release data the case was never even
looked at will you is the default to
release release data or is the default
that you don't release data if you don't
get a positive notification or or or any
reply from the uh notification Authority
um and and so we will as service
providers we believe the default should
be no no we don't release data if you
haven't even looked at the C the at the
case um but and and we know already that
that building the capabilities in a lot
of countries will be very very difficult
they will have a a big issue in in
actually building um the cap the
capacity to look at the notifications to
really do the checks and there's also no
Registries most countries even the
authorities don't know who is a lawyer
who is a priest who is a journalist and
things like that there is no Central
register for these functions so who will
raise the prote that is still a very big
problem that's beside all the technical
arguments that um some countries
obviously think that digital signage is
still some some novelty um and that
verifying a request or or they we even
have proposals that they say yeah well
individual law enforcement can issue
that but we only signed that centrally
so you basically have a digital
signature from some Central Authority
within that country but you don't really
know who was the person who issued that
really the person um or is that person
authorized to send the request because
we believe that this will happen
automatically if they send it through
the national system they will
automatically sign it and then send it
out there will be no um no actual um uh
responsibility which can be assigned to
a certain individual um uh obviously the
providers ask they can verify everything
automatically and digital and that there
should be capability flag or something
like that in there who can actually
authorize which type of Quest and things
like that so as a um so this is what
what can still be done um uh Lobby your
Ministries um and also I believe we
should have a or start a discussion if
we can't build an association or
Federation of nonprofit affected
entities who will register as these
designated establishments because you
can several service providers could use
them we could have thousands of service
providers basically registering through
one entity and run this through the
national system because there will be no
volume most entities will never or most
service provider will never receive a
single request with this huge broad base
of tens of thousands of organizations
will now have to um sign up as a service
provider and and never had to do this
and they'll never receive a request so
how can we cope that uh all at least the
non-for-profit a uh organizations will
find a way to do this in a way that you
don't have to pay a monthly fee or or
maybe a very small yearly fee or
something like that in order to uphold
that um
uh that requirement but um so this is a
discussion I hope we can we can start or
can have um I haven't decided on a way
to do this right now but um maybe we can
do this within CCC or something like
that I think uh there there will be a
good starting point here all right yeah
thank you and um I'm happy to if we have
time yes uh thank you Applause for
walking us through this really complex
regulation um we do have five minutes
for questions uh which is why I would
first uh call our signal Angel if we
have any questions from the interwebs
already and for everybody else please
keep it short okay yeah signal angel
you're good to go yes the first question
is does this list of providers include
things like power like sorry vacuum
companies and power inverter companies
because we've seen talks how they also
store data about you that's a very good
question and the question really is do
they collect and store data and is that
done on the users's request so we're
having that discussion right now if if
the uh uh um the appliance would
actually collect data not um on on the
user request but because they want to
sell it or whatever or to better their
product then this was not would not be
part of it but if you if you have it um
as uh for example you said power
inverters or something like that
sometimes you you there actually store
data in order to get good Pro profiles
on how is that uh how is your usage how
is it effective and things like that so
there is this is data storage and
processing which is explicitly mentioned
in the text and since there are no
Provisions that this is not covered um
uh we we don't see that this is um not
applicable for that right now okay
thanks um Mike three this time thank you
very similar question um does it also
affect email Services run by a company
only for their own employees or um like
I run a mail server just for my family
would that also count as a service
provider um no private individuals are
not uh are not in there so it needs to
be some organization uh uh providing
something for their their members or
users or something like that so um
private individuals are exempt they are
not part of the
regulation so also a company running the
mail server for their
employees this well you would you would
never have the confidentiality which is
required in this so this is also not not
part of it because law enforcement would
never accept to send something to a
company which would then inform their
employees or or cover their own assets
sorry use that so so no they they are
not part of the
process thanks uh Mike one one question
and short please um okay um just for
clarification so when I'm a service
provider hosting a masteron server for
other people I need to respond to
requests within eight hours so I'm not
allowed to sleep for8 hours I need to
check my email every 7 hours and there
is no protection from for naal security
so the Spanish police might be able to
request service providers for the data
of the German secret service or the
German W witness protection programs
right um well it needs to be a criminal
offense so this is for example secret
services and things like that are out of
scope however in some countries they're
not completely separated from from the
rest like in France or Austria and so on
for example the Secret Service uses a
service provider for example the Telecom
to host
data what what can I say it's as long as
it's a service provider it's part of it
and they could request it um who's
actually behind it uh is is not part of
the of the regulation and for your sleep
part that is the big problem right how
would you how would you address these
eight hour time frames but obviously you
can have some notification scheme and
normally unless you're a very large
organization you would Ty Al never
receive a request but you would need to
ensure that they can you can basically
get
alerted I believe we have another
question from the internet Signa Angel
uh yes in in Internet is saying uh it
states in the slide that the data might
be required to be preserved until
further notice is there some provision
for how long does that mean or is that
really forever no no the pration of
order is for 60 days if you don't
receive a proper request uh within the
the 60 days you can delete the data and
and that's it so there is a very clear
um very clear time frame for that but
the the the requirements to get this are
lowered so basically law enforcement can
say oh well we're working on this
protect the data because you need this
because in in a lot of cases it's only
there for seven days or something like
that log data and things like that so um
they want you to protect it so that it
doesn't get deleted because it takes
some time for them to get it properly
approved by a judge um and in some
countries we have to get this approval
by by a judge and a court order
otherwise you can't request the
data okay time for last question from my
two please make it short yeah so uh how
this law deals with the authenticity of
the data like uh when the law
enforcement has it does have they have
to have like a signature from the until
that they um give it give it to like
this external law enforcement I mean I
asked this question because for example
in German criminal law as far to my
knowledge when the law enforcements gets
a data they don't have to do anything
about this authenticity and like a
Judiciary has this perfect trust to the
law enforcement that uh they didn't do
anything with the data yeah yeah it's
this is a very good question because the
question is also about how do you sent
data is it encrypted is it authenticated
is it signed um uh and and will it be
usable in court right and and that is so
as a service provider you basically
represent that this is to the best of
your knowledge the data which was asked
for and you have to sign up you could be
asked as a witness to to represent that
this later if there is a court case
right we're talking about collecting
evidence for a criminal proceeding right
now which doesn't mean that this is
exactly what will happen in in the court
case right so there could be um an
extension there where you asked as a
witness to represent that this is really
the data which uh which you collected to
the best of your your knowledge but it's
an interesting question because the
system which is proposed right now is
even incapable to use to to be used for
huge amounts of data for example there's
there's we're discussing a side channel
on to to how for example cloud data
could be released because the system
which is currently in place or
considered to be in place is limited to
one gigabyte of data and there's a lot
of cases where this is a joke right so
it won't cover it so there will be
separate channels and a separate systems
and they all have to validate that the
data is authentic and that that it is
signed for on this spec Channel as well
so the the providers are they they they
have to sign everything they release all
the messages all data that least needs
to be
signed all right uh thanks for the
questions thanks for the answers um I
know there's a lot to discuss many
questions but our time is over thanks
again Claus I believe you will be here
for a couple of
[Applause]
[Music]
minutes
[Music]