Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1121 Thanks!
[Music]
welcome everybody to our next talk
electronic evidence and criminal matters
an introduction and critique of the EC
proposal for a regulation our speaker is
Claus leld he is a member of the board
of the echo Association of the internet
industry and he's also in the board of
directors at the D kicks group IG and um
usually at First Sight you would think
that it is a good idea to have an easier
way for law enforcement authorities to
secure electronic evidence when there is
the suspicion that maybe there was a
crime committed that sounds reasonable
at first but um as is often the case
with such proposals there are some shady
side effects that people either have not
thought of or they have thought of them
but they don't care particularly there's
a lot of concern when it comes to data
privacy and K Claus is going to tell us
now what the problem is and what should
be done about it so please give a big
warm Round of Applause for Claus and
have
fun yeah proposal for regulation on
European production and preservation for
electronic evidence and Comm meths is a
very ungainly name and um it it has come
out as cumbersome as might expect so
what's it all about um it's actually a
proposal from the commission um from
April this year um with a proposed
regulation regulation meaning it will
become direct law in every country so
there don't need to be any transmutation
into National Law um and let's be very
clear right from the onset this is about
access to store data by law enforcement
so this is not about Mass surveillance
or preemptive measures or something like
that there needs to be an ongoing
investig tigation um and this is about
um gaining evidence for that ongoing
investigation um so it compels service
providers who enable legal or natural
persons in one or more member states um
to use the services listed I'll explain
what that means um to directly cooperate
with law enforcement from another member
states usually that never happens so
you're only talking to law enforcement
in your own member State um and that's
actually what is different um so the
scope of the regulation is that a
service provider is supposed to provide
a full copy of all store data so I go
into data types a bit later as well um
from the inquiring member State um so
data types could be everything telephone
records email transaction data uh
communication data cloud storage
anything um and the
authorization uh and the limitations for
the exess exclusively follow the law of
the request member State meaning the
state where the investigation is
actually happening so it doesn't matter
where you are um which law system you
you under um the only law which is um
required to be upheld at that point in
time is the law of the inquiring member
state which is one of the big problems
of The Proposal um so isn't even a
requirement to even involve the state
where you reside in uh or even inform
the authorities that data was requested
from a service provider in your country
um uh so which type of services are
covered I think that's one of the most
essential part so the commission um made
a a presentation for that at the cop
meeting in in May um and gave some
examples of service providers so
everything you'll see in the next three
slides is not from me this is actually
the examples provided by the commission
um uh and it it's three areas it's
electronic Communication Service is
defined by the um European electronic
communication code um it um uh is also
in Information Society services that
means things like social networks online
marketplaces
um other services facilitating
transactions uh hosting service
providers all this stuff but also
Internet domain name um regist and
Registries IP numbering services and
things like that um so um what were the
examples given by the commission for
Access service they used BT forone every
internet access service be it via um fix
line or mobile is basically covered that
also covers um in principle at least
Wi-Fi providers um even so it's very
difficult obviously to get some data
from them um it's also interpersonal
communication services so everything uh
email SMS uh stuff like that um so they
use kpn vont 2 la la la but you'll see
also telegram Skype uh WhatsApp signal
so there after every type typ of uh
interpersonal communication also email
Services everything um a bit more tricky
is the conveyance of signals that's also
one area so um what the commission
listed here is um uh in principle also
ISP satellite Network providers but also
radio and TV broadcaster so they could
basically tell you oh if you have a
subscription was that used for somewhere
else um to gain insight into where
people were using the service from for
example um however in having further
talks with the commission we found out
that might also include iot Services um
all sorts of other Communications where
the um the only um uh the only
requirement is that the company uh
offering this service controls the
transmission of the signals over the
network which obviously Falls for every
closed service um so it's a very broad
definition um it gets even worse if you
look at the Information Society services
um they're obviously looking at social
networks like Facebook Twitter LinkedIn
Google um uh uh online marketplaces
Amazon eBay uh Twitter hun was um uh
explicitly mentioned as examples um but
also and this is where it gets tricky um
hosting service providers like um Amazon
web services overh cloud service
providers for corporate infrastructure
um what does that mean basically
everything which is stored with someone
else could be exited through the that um
uh regulation um and they also mentioned
um services like YouTube for uploaded um
uh videos Microsoft Azure Microsoft
Office 365 I was kind of like oh wait a
second does that mean a documents stored
there yes that's what it means um uh
online gaming websites or even things
like iTunes so what did you download
there and when did you use the service
from where um this is all stored data so
you could basically get um uh
transaction data from these Services um
for the uh interdomain IP numbering
service they use dripe as an example for
the IP addresses uh for Registries uh
your ID as uh the D registration service
but that obviously goes for the German
registration service and all the similar
ones as well so this is just examples
registers like ovh.com uh kpn or things
like that but also privacy and proxy
service providers United domains was uh
uh listed because they um they provide
the um anonymity service um nowadays
under the gdpr um so that you can't see
who's actually behind the domain so they
can Target these as well in order to um
release who's actually um ordering the
service um well to be very clear um it
is all data stored in a single member
state which is supposed to be released
to requesting member states law
enforcement Authority within 10 days or
in emergencies even within 6 hours so
service providers are required to
deliver a full set of data stored with
them within 6 hours if that it's
declared a very important inquiry um
without involving your national uh
authorities at all um the idea behind it
is that um each EU member state has its
own Sovereign laws um and that the law
enforcement procedures uh can be
followed through to investigate in all
EU member states um regardless of the
locality of the actual store data
um the service providers are not even
supposed to check the legality of the
request um and most often they will not
be able to do so because they don't know
the the law system of the country where
the inquiry actually comes from uh and
that is not harmonized criminal law is
not harmonized throughout the EU so um
uh the the uh the time frames what can
be prosecuted what even is a punishable
offense things like that is not
harmonized throughout the EU um at all
um can leers do that already that's the
question I often uh hear um uh in
principle they can all they can already
do that they can access all sorts of
stored information uh if they invest if
they have an ongoing investigation and
to further a case or further the ongoing
investigation they can already submit a
request for store data but not to the
service provider they'll have to go to
the law enforcement authorities of the
country where the service provider
resides um uh or the customer resides um
in order to get that processed so um the
authorities of uh where the seat of the
service providers will have to process
um the request and will only forward it
to the service provider if that is a
punishable offense under local law and
um uh and the request warrants a release
of the data there might be other
Provisions why that is not not
acceptable to release the data
um uh this is all um circumvented by
this um proposed regulation um normally
it's the obligation of the local
authorities to observe our local laws um
that the individual fundamental rights
um and all legal remedies are given to
the person in question and things like
that that's all upheld under the normal
procedures the multilateral agreement um
by the local authorities um so what are
the challenges to individual rights um
there are certain problem areas
identified obviously the enforcement of
few process and the legal remedies for
the individual are not clear at all if
you live in a country um data from you
is requested um what do you know about
what is happening in vaval land whatever
I mean uh what what this um what the
legal remedies are there how do you
actually file a court case what are your
rights and under their data protection
laws and everything you just don't know
um and there's no harmonization in that
as well um even the information after a
case is closed and you were cleared
maybe to that you're informed that data
of you was handled at all there is no
harmonization for that as well you might
never learn that that your data was
actually released typically under
national law there are Provisions that
this happens to this and that extend one
way or the other this um uh this propos
regulation does not cover that at all
only the law of the requesting country
is um is taken into account so we have
some examples on where that might affect
people um a good example is abortion in
Poland it's illegal there you might have
several years um of uh jail time for
that um uh in other countries it's
completely legal so if you would use
email services to arrange for that in
the Netherlands you might be very
careful that um uh that you won't have
that visible in Poland um still it might
be requested now from the Netherlands um
and you might be prosecut prosecuted
based on that um we had a good example
in Germany earlier this year when pimont
was um even within the authorities they
actually um put him um uh under hold at
some point but the German um Court ruled
wait the offense where the um arrest
order was uh was put into effect that's
not even prosecutable in Germany so they
had to release him again but everything
um which would have happened in between
telephone calls cloud data anything
emails um sent from that could have been
requested by the um Spanish authorities
if that were already law um good another
good example in um in Austria it's legal
to use um uh tall data um in uh uh to to
uh to actually build a case against
someone where did did someone use um the
roads um there is a provision in German
law that you can't do that so the data
of toll collect cannot be asked for by
the authorities to build um a criminal
case um there's no provision that this
is not going to happen meaning data can
be inquired from a foreign country which
your national law enforcement
authorities cannot even
inquire um which is it's very hard to
explain to local enforcement that they
cannot ask for data which other European
countries can ask for um we have the
same problem with the types of um cell
data for example or location data from
cell phones um in Spain it's much you
you can do um Mass inquiries even for
for whole zones or whole cities which is
illegal in Germany um so a typical um uh
example from telefonica they told us oh
it's normal we release um several
hundred thousand um data dat sets in for
one inquiry while in Germany this would
be completely illegal um also there is
no harmonization for the treatment of
store data personal so very personal
information per photos Diaries um but
also if you look at the fact that they
want to to go for cloud service
providers for Enterprises what about
company secrets about intellectual
property rights are we supposed to
release everything your whole cloud
storage Co whole corporate networks
cloud storage to law enforcement based
on a request which might not even be
prosecutable in your own home country um
it's it's very unclear and that has not
been um remedied in the talks over the
course of the year um interesting enough
a similar measure would never be
accepted in the physical world so
imagining um the Hungarian police
ringing at at some flat in vien
somewhere in the morning just looking at
it copying everything they want and
leaving again not even telling the
Austrian authorities they were there
completely Unthinkable no one would
accept that um or no country would
accept that um but in the digital world
it's exactly the same so they they think
well why not it's just Digital Data um
uh the same is um they have certain
constitutional rights um um best one
well obviously I know that best because
I'm from Germany but we have something
just called the can shs in Germany that
is um the the core private life which is
protected even from law enforcement they
cannot look at this data um uh and in
the listo contract there was even a
provision for that that no European um
law can infringe on that right um this
one does if it becomes law so um uh
obviously it's not thought through and
it needs some amendments um there also
procedural problems um so every judical
authority of a member state is
authorized to issue a European
production and preservation order and
directly contact the service provider um
that offer the service so we're talking
about tens of thousands of service
providers throughout the EU but we're
also talking about thousands of
authorities which are in principle
allowed to issue these um production and
preservation orders so in Germany this
is 900 eligible authorities we counted
them and we did some counts in some
other countries so we estimated to be
13,000 um authori which can go to every
single service provider and ask them to
produce data an impossible amount how
should the service provider be able to
detect manipulation how do should we
even know that um that this is a genuine
request that the The Authority inquiring
the data is even allowed to do so um so
possibly the EU commission could publish
an official list of authorized agencies
but it says oh no we're not going to do
that um this is the individual a Count's
responsibility and um the countries do
not want to publish this list of
authorized
agencies which makes it even more
strange is that um coming up with the
idea hm is this going to be electronic
inquiries which are signed which we
could maybe check upon no no no this
could be paper it could be facts it
could be anything um so um another area
which is not um uh harmonized and where
the uh regulation has problems is um the
regulation of Maximum penalties or
minimum penalties it's a bit unclear um
uh one of these orders can only be um
sent out if the um if the crime you're
accused of is punishable in this stat
with a sentence of at least 3 years but
this is um it's it's not really very
much so there could be fraud there could
be anything so 3 years is a joke um
especially looking at the fact that
there might be several countries
inquiring the data and um even if in
your country or in in your neighboring
country it might be only two years there
could be another country in the EU where
there's a 5-year penalty on exactly the
same crime so this doesn't really give
you anything um and a case- by case
examination of the service provider is
not possible anyway how should a service
provider be able to check if that
specific offense which he's not really
even in detail told about because not is
not allowed to know what the specific
offense is and how should you check if
that is if that legality is upheld um
and if if the request of the assessment
of the state inquiring the data that yes
this is an offense punishable punishable
by at least 3 years um is is actually
true the service provider will not be
able to do this
um uh and and the same thing goes for
the question if if that is punishable in
my country at all um so we cannot not
really tell
um these problems could be solved by a
binding uh list from the European Union
and that would be sensible in uh
considering harmonization is what
they're really trying to do um so that
specific offenses are listed in in sort
of a catalog where you can say okay but
this this offense on a paneuropean level
we see this minimum sentencing or things
but uh the the states have signal they
have no interest whatsoever and
harmonization in the criminal laws so
they don't want to produce that catalog
and they cannot agree on a catalog
um so
um it's it is is very clear that
um obviously companies should not be
permitted to produce data for foreign
authorities that would domestically not
punishable um but uh it is UN very
unclear right now how this can be
achieved how um uh uh how a service
provider is even able to check that
anything he receives is um is
genuine um uh the same goes for the
relationship to third party States
um there should be a provision in there
that transfer of the data um gained
should not be allowed to be transferred
to a third party um so so uh one
European member states requests data and
then shares it with the US for example I
think it's very clear that this should
not happen um uh but at the moment uh
individual member states can negotiate
their own individual agreements um with
whom they share data under what
Provisions um and um we think that there
should be um something in um in the
regulation that says no this can only be
done through the entire Union if for
example the US Cloud act there is a
provision that data is shared with the U
it should be harmonized it should be the
same regulations the same way to do this
um throughout the European Union so that
not one country can do their own
individual um uh contract on that um uh
the same goes for the existing process
there is a process um of voluntary
cooperation and a lot of countries have
individual um contracts between each
other um on how to share data so uh
whatever the Netherlands and Germany
have a contract Austria and Germany have
a contract contract um France and Spain
have a contract and how to to um help
each other in gaining this data um uh
currently it's not clear um uh what is
the leading law um will this um be the
new regulation be the conclusive
agreement or will the individual
contracts still be uphold uh especially
if um if there are lower standards and
in some cases there are lower standards
um uh uh for for for this cooperation
than what the epoch now stipulates um
and uh obviously this also goes for the
non-eu states um and the production of
evidence there um so it must be very
clear for all parties involved what is
the uh the new standard and which
standard should be
applied
um even worse there are no technical
Provisions whatsoever the proposed
regulation is only about procedures and
um U minimum sentencing and things like
that um there isn't even um uh an
opening Clause to come up with a
technical
specification um so but in order to make
this a timely response if we consider 6
hours and things like that we need a
technical regulation um if something
like this will even come to pass um so
um for the European investigative order
there's an Etsy standard which secures
the integrity and the privacy of the
data while it is transmitted it's
obviously encrypted um for the epoch
there's nothing it's not even clear how
this is supposed to be transmitted you
could receive a fact and then what do
you do you produce electronic data you
don't even know what to send it to
unencrypted via email um that's there's
no provision in there at all and if the
opening clause for technical provision
will not be in the proposed regulation
then you cannot have a technical
provision afterwards you need to amend
the regulation um so this is really a
requirement which is absolutely in
essential uh in a digital world um I
can't even understand how someone can
come up with a proposal for electronic
evidence which does not say it needs to
be transmitted electronically I mean
it's well
okay yeah well for for people versed in
uh digital matters it's it's I I don't
know it's um
so the same goes for companies I mean
obviously a lot of you probably work for
providers or so
or or some some companies which offer
Digital Services um so in in in
principle um unified procedure for
single Market I mean we're working on
the single European market for
electronic communication for electronic
goods and services so uh in principle
the idea that there is a unified
procedure uh on on how to access data
and what data should be accessed is is
not a bad idea I have to admit it's
sometimes very difficult to work to to
work in the current system where there
are individual agreements between some
states and um and and what can be shared
and how it's done is a bit unclear and
you never know when your Lo own local
authorities talk to you and request some
data if this is actually for some other
country you never know so is procedure
would be very helpful um but the the
direct contact of um of foreign State
authorities with with you as a service
provider in another country um means
there is a discharge of sovereign tasks
by your own State um and that is
something uh which we view is very
problematic because who is responsible
to uphold the rights of the individuals
in that setup will that be discharged to
to the to the private company the
private sector it's um something which
obviously politicians are trying to do
um all throughout the EU um typically
within national law so there's a lot of
State responsibilities being outsourced
to private sector companies nowadays but
on international law or International um
treaties you you almost never see that
um so um why is that in here why are um
are the state responsibilities simply
ignored um and uh the the individual
countries have no rights no safeguards
nothing in there to protect their own
citizens um that that we as industry few
has a big problem um because obviously
this is all also about liabilities um
uh it needs to be clear for a service
provider if I release data based on that
regulation um that I'm only acting on uh
an official in an official capacity
working on an official state order and
Carry Out measures that have been
prescribed by well yes some other state
but at least by some state so I'm not
liable for releasing that data under the
current proposal it's not even clear if
the user could not sue me for the
releasing that data um yes it is EU law
but it's very unclear um how that
relates to the national law about
safeguarding data of the individuals um
uh actually there there is one provision
is in there which states that if I don't
follow the order if I don't release the
data in a timely manner I could be fined
up to 2% of my turnover um as a as a
company um so um again very uh very
Hefty um uh uh Financial Risk not
responding uh in in emergencies within a
couple of hours so will I be am I
willing to take that risk am I willing
as a company to uh to to not follow that
order and actually do some checks do do
some legality checks um um I might not
um if if I'm a large company I'm talking
about um several million Euros or even a
billion Euro or something like that in
potential SS for not following that
request um uh it's it's very difficult
so this should really be uh put into uh
into the proposal
um uh it should also be very clear that
um if that was a manipulated request and
I could have no means to check this I
have no means to do a signature check or
something like that if if I receive a
fact with a stamp from some Court
somewhere I cannot verify if that is
even a a true court if that even exists
or if that has the authority to request
this type of data under the current
proposal I'm supposed to Simply release
data um I'm not even supposed to
properly check this so um can I be made
liable if that was fraud say Court fraud
um that um we think is a big problem at
least for the companies um how can you
do business in an environment like that
um and obviously you cannot check if
that uh if if that is legal in 28
different legal systems um uh and it
should also be clear and that's also not
part of the uh of of the proposition
right now um that the data cannot be
used for something else um so it was
requested for for one uh for one thing
and it can be used in in a different um
legal case not even that is in there um
and also it should be very clear that um
that evidence released to a law
enforcement Authority and then it it
becomes clear that this data should not
have been released that it cannot be
used in in court um and um that is also
not in
there um so um what is the current
status of The Proposal um where are we
in the process um it's not law yet it's
not passed um the European data
protection board adopted um a resolution
it said this is very critical and it's
not supposed or shouldn't happen um uh
uh uh on the 26th of September um but
the council so the the EC Council uh
adopted it as is without amendments on
the 7th of December so um if it goes
through Parliament as well um then it
would become law immediately um if the
parliament stops it um then um uh then
there will be trialogue um uh disputes
um and it can we can actually still
prevent it from from become law um um
the parliament held a hearing on the
28th of November um and it's currently
not clear if there will be any further
hearings or proceedings um before the EU
election in
May um so what is required and that's
where I say it should be a call to
action um please um in this case really
um NOS um private individuals and
companies we're all on the same side
here um this should not come to pass as
it is because it will really rob you of
of um of of clear law and a clear system
on where you are um on what is really um
uh the law system you work in and you
can actually have a uh have a clear
understanding on of what if you save
something on the net or if you put
something in storage somewhere if that
is not released to someone else um only
a handful of companies opposed the
regulation um so there was active um
there was active opposition to that that
was Germany the Netherlands Finland and
Gree gree and also Hungary in the Czech
Republic but on different grounds
because they thought it doesn't go far
enough um so um well that's the typical
um things you have in in the um in the
council um however the the the primary
advocates for the proposal were France
Spain Ireland and Belgium so they
sponsored it um so especially in these
countries it would be helpful if people
um would become active talk to their
governments locally to their parliaments
um and actually say okay well what is
happening here why do you support this
support can still be withdrawn until
this was actually um adopted um uh also
obviously people should talk to uh to
their members of parliament um and make
clear that this is not something which
should become law um so um as I said
there is still some some time to act
probably the first quarter at least um
maybe up until after the European
election in May um and I I hope that
that that there will be some action that
people see that this is a big problem
and um these production orders should
not come to path um yeah thank you very
much um materials used um I recommend
these um uh as reading so there was the
opinion of the European data protection
board the original proposal uh but also
a study for the parliament done um for
the LI Committee of the um of the
parliament which also strongly um
request the parliament not to adopt this
so um uh if you're interested in the
topic um look at these materials and um
yeah I'm uh open for questions and
[Music]
further thank you very much for the talk
Claus we still have quite some time for
questions and answers so if you have any
questions uh you can move to any of the
microphones we have here in the room and
then we will be happy to take your
questions are there any questions from
the internet so far doesn't seem so
there still still thinking about it
maybe so let us start with microphone
number five uh when pushing for the
electronic signatures and the uh proof
to have a valid request wouldn't it also
be wise to uh ask for a secondary legal
check by the local Authority uh because
when you have a
um format you can also speed up the
check by the authorities um yes we we
thought that well actually what what the
service providers proposed was that it
should actually be sent out from the
local authorities to some Central um uh
agency within a state and they well the
original requesting authority to sign it
the the outgoing um uh Central
authorities should have signed it then
there was an inbound this is called
double tund so that both countries
actually check on it and then only then
it's forwarded to the service provider
and you would be able to check
signatures um on this so so that there
was IL legality check and also an
Integrity or an authorization check on
this but it was flatly refused even in
Germany the bundus Ed um uh um bundus
ared for use teats and they said oh but
we can't do this 24/7 within 6 hours
it's impossible um so every service
provider is supposed to do it but they
cannot do it but the check the
that the legality check outbound and
inbound we think this is absolutely
mandatory to
do thank you next question for
microphone number two thanks Claus for
this for reporting about this nightmare
um when there is an incoming request
from a local Authority let's say to D
kicks um is there any proposal in which
language it should be should it be in
German or in Polish or are you expected
to learn all these uh languages um it's
a Well actually D DK cannot have these
requests but different story um
uh actually every company or every
service provider is supposed to publish
an address to forward requests to and
the languages they are willing to accept
um these in on their
website don't ask don't ask me why we we
thought that um as with the list of
authorities being eligible to request a
list of service providers which can
actually receive these um would be a
nice thing to compile on a on a national
level and then be exchanged um uh maybe
through through europol or something
like that but um again flatly refus
because um one it's too difficult to
compile this list of authorities uh who
can inquire um and electronic signing is
completely out of the question um there
supposed to be a couple of years before
the the um local authorities can sign
stuff um and um also um the the this
finite list of service providers who can
actually receive it um uh was um
supposed to be impossible to compile
because uh you've seen there's some some
rather open um uh definitions in there
like these um uh uh uh controlling
signals on the network stuff right um
anyone who's who's uh transmitting and
storing data uh in in some fashion could
potentially be a Target so um the
authorities thought that it's impossible
to compile a complete list of uh uh
potential recipients I'd like to remind
the people who are already leaving to
please do so quietly and everybody else
was in the room to also be quiet next
question for microphone number three
please so since you have a big German
audience um sorry the echo uh since you
have a big German audience uh which of
the German European Parliament
politicians support and oppose this and
which of them do you think should should
we direct our attention to I honestly I
cannot answer that because I haven't
talked to the German members of
parliament because we were able to
convince the German government that this
is a bad idea and they opposed the
measure altogether um so we need to do
this now um the and we we also need to
go to Parliament of course but my
colleague in Brussel already did this
but I don't know who he' actually talked
to and um who didn't um that would be
Thomas BM of eeko he's talking to the
parliament
there microphone number seven please yes
uh how are the sending authorities
supposed to identify where to send a
request like even if you look up on an
IP address it might not actually be the
company that uh that's responsible for
the server it might even be like the
Upstream ISP of the collocation company
that has a customer that's where he
supposed to send a request um a very
good question no I I seriously cannot
answer the The Proposal doesn't doesn't
stipulate that there is no provis Vision
in there how to find out who the actual
service provider is um so um that but
but that problem is there today as well
so they they they need to identify who
the service provider is um today as well
so there's really no change for the um
for the requesting authorities there
microphone number six
please hi thanks for the talk uh I was
wondering so you you said uh attacking
States lows are above the targeting
targeted States laws um could this uh
could there be any protection like if my
States Constitution says uh a foreign
law cannot apply here uh could it
invalidate the
regulation that's what we're aiming for
we hope that this will will actually
come because this is what what would be
required if um that for example there
are um uh preventions to use data for um
uh doctors and
members of parliament and things like
that that's not even in there as well so
so if if there are local um U
requirements that data cannot be
released that is not upheld as well um
so um and U this actually a good
attacking point for par for members of
parliament to tell them well you know
what under this even your data can be
released um and they're typically very
proud of their um of their protection um
uh
it's this this proposed regulation
doesn't clarify this you will you have
to release the data no matter what
because the presumed check already
happened at the requesting entity um and
it's only a question if it's punishable
with at least 3 years in the requesting
state so your law doesn't matter at all
um in the uh regulation as it is right
now now the time of the internet has
come and they will be asking their
question yeah I actually have kind of a
double question for one does is law
enforcement actually defined in a way or
is is it um just law enforcement without
any
definition it's um well it is actually
um some for some things you need a court
order as well so it's basically um uh
police um the state attorneys um uh and
the courts uh on the different levels um
and um in under some local jurisdictions
um it's very clear that data can also be
requested by secret services and things
like that as well so they would probably
fall in that in that range as well even
so uh it explicitly says um that that
it's only for criminal proceedings so
um it's it's very difficult to tell if
they will probably be able to to send
this through some police agency or
something like that so but it it's
clearly just for criminal
proceedings and does um one actually
need to go to kind of a judge um in even
in the requesting country or is it
completely free to send a request that
depends on what the local law says if
you can request IP addresses names
certain types of data in the local Law
Without a judge so if police or the
state attorney can do it then only their
signature is required if the local law
states that it's the judge is required
then you would need the authorization by
a judge however if you want content data
that's a special point in there um so if
you want content whatever of a cloud
service or something like that it will
always require the signature of a judge
but this could be from a a local Court
microphone number two your time has
come please do go very close to the
microphone for the wonderful talk and
preparing it in such a short time uh I
would have two questions that uh popped
into my mind one of them is that we have
extensive cooperation contracts between
um legal entities within the European
Union so if I see this correctly so far
um the proposed procedure would allow to
basically play it um in tandem to get
the information so my police is going to
ask someone else's police the police
from another state to ask for data that
I can that that the police can't ask for
and I don't see how this is omitted in
any
way well had this I had this in in the
presentation that we think that that
only the the the um
uh the state where there are actually
criminal proceedings should be able to
to request the data um but it's not very
clear in the right now in in the uh
proposed regulation um so this needs to
be clarified we think that especially
this this part that data can be handed
Pro handed on to someone else because
you have a different contract in place
that this should be ex explicitly
prohibited um under this uh under this
regulation it's not part of of the uh
proposal right
now
microphone number two please do ask you
a second question um the other point was
when does data count is being
stored is this like two minutes 2
minutes after I finished my phone call
or um an hour or 24 hours or um well the
proposal doesn't say um typically that
is also something which is under under
local law and it actually differs from
country to Country what is considered
stored data but it's typically all sorts
of um uh of account data all sorts of uh
data which is stored more po like emails
cloud data and things like that it's a
data in transit is which is only
temporarily stored somewhere T does
typically not count as store
data microphone number
five as an Enterprise can I um skip or
be out of the scope if I run my own mail
server like universities or um other big
companies um well if you if if you run
your own Services you're you're
obviously out of scope for the proposal
because it need to be a service provider
enable enabling other persons in order
to do that and obviously it wouldn't do
much good to to send you a request to
release your own data um uh but uh
universities and things like that that
is that is really up to to local law so
in under certain Provisions I don't know
that for for many countries but I know
that in Germany for emails for example
they have an exemptions they don't need
to provide that um so so
um this is part of what what I mean when
I say we need to to actually change
local procedures as well um to clarify
who's within scope and who's not this is
all about oh it's kind of like up to
local law but if if I'm not required to
store something or to actually have data
um and then someone from Spain or
whatever inquire something because uh
companies there are required to to to
store that um well obviously if I'm not
if I'm not storing anything that I can't
release anything but it might work the
other way around like um in Poland they
have data retention for 5 years um in
some other countries they don't have
data retention laws at all or maybe even
maybe six months um and then you request
something and you receive data for 5
years that's obviously not intended from
from the requesting entity so this might
work both ways and the internet has the
honor of asking the final question for
the session uh so one kusher user asked
if we should use the law against the
politicians which um proposed it if it
actually comes into effect to kind of
show them how bad it really is well if
you if you get some other law
enforcement agency to request that data
yes you should you could you could do
that um because there's no provision
against it but um uh it's I can't really
answer that sorry all right anyways
thank you very much for all of your
questions thank you so much for being so
active also thank you very much to Claus
again for giving this very informative
talk please give another big round of
warm Applause to Claus thank you thank
you thank you
[Music]
yeah