Steven De Schrijver and Thomas Daenens of Astrea look at the impact of two interesting decisions in the Yahoo! case.
"With its decisions of 18 January 2011 and 4 September 2012, the Supreme Court has attempted to turn the desires of the law enforcement authorities into reality, by giving its own interpretation to the concept of electronic communications service provider and by granting extraterritorial powers to the Belgian prosecutors."
The Belgian Supreme Court rendered two interesting decisions in the Yahoo! case that may have an important impact on the international fight against cybercrime.
The issues that were dealt with related to two key questions. Firstly, can Yahoo! be qualified as a provider of electronic communications services in the sense of Section 46bis of the Code of Criminal Procedure (CCP) and thus be subject to the obligation to cooperate with law enforcement authorities? Secondly, can a Belgian public prosecutor validly send a request to cooperate and provide personal user and communications data to a foreign provider of electronic communications services that has no presence in Belgium?
The answers the Supreme Court gave to these questions are quite surprising.
Section 46bis CCP provides the following: “When tracking crimes and misdemeanors, the Public Prosecutor can […] based on any information in his possession or by means of access to the customer files of the operator [of an electronic communications network] or of the provider [of an electronic communications service] proceed or order to proceed to: 1° the identification of the subscriber or regular user of an electronic communications service.”
On the basis of said section, public prosecutors can issue requests to providers of electronic communications services to provide them with personal and communications data of their subscribers, such as identification data, IP addresses, communication logs, etc. Failure by the service provider to disclose the requested data is punishable with a criminal fine of up to €55,000.
When Yahoo! received a request from the public prosecutor in Belgium to provide personal data on the basis of Section 46bis CCP, it did not disclose such data, as the request was sent directly by the Belgian prosecutor to its offices in the US. It asked the prosecutor to send the request via the regular international procedures for mutual assistance in criminal matters, ie, with the intervention of the state departments of both countries.
The Belgian public prosecutor, however, refused to do so and decided to prosecute Yahoo! on the basis of section 46bis CCP for failure to cooperate. He basically argued that Yahoo!, as a provider of electronic communications services, was “virtually present” on Belgian territory, because its website was accessible from Belgium. Therefore, Yahoo! was subject to the obligation of co-operation set forth in section 46bis CCP.
Before the Criminal Court in Dendermonde, Yahoo! argued that, firstly, it could not be qualified as a provider of an electronic communications service; and secondly, the request was not validly issued, given that it was sent directly by the Belgian prosecutor to its offices in the US, rather than via the regular international procedures for mutual assistance in criminal matters.
Definition of “provider of electronic communications services”
Electronic communications services are defined by the Act of 13 June 2005 on electronic communications as “services normally offered in exchange for payment, which entirely or principally consists of the transfer, including switching and routing processes, of signals via electronic communications networks”.
Thus, according to this definition, electronic communications services are services that consist of the transportation of signals (data) over an electronic communications network (eg, broadband Internet access, telephone lines, cellphone connections). It is clear that the scope of the Act of 13 June 2005 (and thus of Section 46bis CCP) is limited to so-called Internet service providers, ie, providers that grant access to the internet and take care of the transportation of the electronic signals over the network. This is usually not a free service, but only offered to subscribers against payment, as is also pointed out in the definition.
Yahoo!, however, offers what is called a “webmail” service. It provides a free-of-charge software application on its website which allows Internet users to send and receive e-mail messages. Yahoo! is not involved in the transportation of signals or information over the network (from and to its servers). This is entirely taken care of by the internet service provider to which the Yahoo! user is subscribed.
In that respect, we believe that Yahoo! rightfully claimed that it could not be qualified as a provider of electronic communications services and could therefore not be subject to Section 46bis CCP (regardless of whether it had or has any presence in Belgium). And the same applies to providers of similar webmail or communications services, such as Hotmail, Gmail, Facebook, Twitter or Skype.
The Criminal Court of Dendermonde, however, ruled otherwise, after which the court’s decision was annulled by the Court of Appeals in Ghent, which ruled in favour of Yahoo!.
This is where the first of the two decisions of the Supreme Court comes in. On 18 January 2011, the Supreme Court argued that “anyone offering a service which consists of allowing its customers to obtain, receive or spread information via an electronic communications network, can be a provider of electronic communications services”.
This interpretation given by the Supreme Court seems to be problematic for two reasons. First, the extension of the definition provider of electronic communications services (and thus the scope of section 46bis CCP) is contrary to the law. The definition in the Act of 13 June 2005 is clear in all respects and leaves little or no room for interpretation. The transmission of signals over a network is an essential element of electronic communications services. Without that, one cannot be considered an electronic communications service provider. Second, the definition set forth by the Supreme Court is very vague. Which service providers will fall within the scope of section 46bis if the criterion used is whether the service offered “allows customers to obtain, receive or spread information via a network”? The website of a newspaper allows customers to obtain information. Should they from now on be regarded as electronic communications service providers? And what about websites allowing people to interact and share information via a forum or blog?
We understand the desire of law enforcement authorities to subject webmail service providers such as Yahoo! to the obligation to cooperate and share personal data with them. Indeed, it may be very useful to ensure (and, where necessary, enforce) the cooperation of such providers in the context of criminal investigations, as they may be able to provide essential information required to identify perpetrators of cybercrimes. In that respect, it is worth noting that most webmail providers seem to be aware of the important role they can play in the fight against cybercrime. Many of them have already made arrangements with law enforcement authorities with a view to cooperating in the context of criminal investigations and ensuring the swift disclosure of relevant personal information. Such cooperation is, however, always on a voluntary basis and does not constitute an acknowledgement on the part of the webmail providers that they would qualify as “electronic communications service providers”.
If one wants to subject webmail service providers to section 46bis CCP, and make them punishable in the case of failure to cooperate, an amendment of the law is required. This would allow the legislator to carefully consider which internet service providers should fall within the scope of section 46bis CCP and to provide for an unambiguous new definition, which makes clear that webmail services are to be considered electronic communications services for the purposes of investigating cybercrimes. This would be much more appropriate from a legal perspective than having to rely on the questionable interpretation the Supreme Court has given to the current law.
The Court of Appeals of Brussels, to which the case was referred after the Supreme Court decision of 18 January 2011, ruled again in favour of Yahoo!. The Court argued that the Belgian public prosecutor has no power to carry out or order any investigative acts outside Belgian territory. It added that the sole fact that “a prosecutor is able to reach the defendant from Belgium through electronic or other means of communication” is not sufficient to conclude to the validity of a request based upon section 46bis CCP addressed directly to such defendant in the US.
The decision of the Brussels Court of Appeals may be somewhat questionable, because it did not explain why the request for information should be regarded as invalid. Instead, the Court merely stated that there was no proof that the request was validly sent to Yahoo!. While this may constitute a violation of the obligation to give proper reasoning of its decision, in our view, the basic position taken by the Court of Appeals is still correct. The fact that Yahoo! has a website which is accessible from Belgium does not make it a company with an actual presence in Belgium. At the time of the request, Yahoo! did not have any offices on Belgian territory and neither did it have any other physical presence. If the only criterion to determine whether a person is present in Belgium, and can thus be subject to Belgian criminal law, is whether such person can be reached through (electronic) means of communication, then virtually everyone could be considered to have a presence in Belgium. It would be sufficient to be able to reach them by e-mail, by letter or by phone.
Nevertheless, on 4 September 2012 the Supreme Court, in its second decision in the Yahoo! case, ruled that the request sent by the Belgian prosecutor was valid after all. According to the Supreme Court, the fact that the Belgian prosecutor sends his request to cooperate on the basis of section 46bis CCP, from Belgian territory to the foreign address of a provider of electronic communications services located abroad, does not make such request invalid under Belgian law.
Apart from its lack of proper reasoning, this decision is surprising to say the least, as it grants Belgian prosecutors quasi-unlimited extraterritorial powers of investigation and prosecution. The question, however, is whether such powers will ever be enforceable against foreign providers of electronic communications services. While these new powers of investigation may be practical for Belgian law enforcement authorities that wish to circumvent the international procedures for mutual legal assistance, which they often consider to be too cumbersome and time-consuming, most states are likely to consider these extraterritorial powers as a violation of their sovereignty. It is therefore unlikely that they will allow the enforcement of any criminal penalty against defendants situated on their territory.
A better approach would seem to provide for a new and improved framework for mutual assistance in criminal matters with a view to speeding up the process of requesting personal data in an international context. As mentioned earlier, a lot of webmail providers (and genuine electronic communications service providers) already cooperate with law enforcement authorities on a voluntary basis and they also do this in an international context, when personal data located outside Belgium are being requested.
This cooperation, however, is only meant to help law enforcement authorities to speed up the investigation. To the extent that any personal data requested is intended for use as evidence in court, the webmail providers are far more reluctant to disclose information upon simple request. This is understandable, given the risk they may run under the laws of their country of establishment. The current procedures for mutual assistance in criminal matters, which provide for the intervention of a local court with respect to international cooperation requests, ensure that foreign entities can validly disclose information to foreign prosecutors without violating any privacy or other legislation to which they are subject. This legal certainty is important and must therefore continue to be guaranteed.
With its decisions of 18 January 2011 and 4 September 2012, the Supreme Court has attempted to turn the desires of the law enforcement authorities into reality, by giving its own interpretation to the concept of “electronic communications service provider” and by granting extraterritorial powers to the Belgian prosecutors.
In our view, a better option would have been to confirm that if the law enforcement authorities wish to consider webmail providers such as Yahoo! as “electronic communications service providers” in the sense and for the purpose of section 46bis CCP, the legislator should simply redefine the concept.
At the same time, it may be appropriate to create a new framework for mutual assistance in criminal matters with a view to speeding up the process of requesting personal data in an international context. It is sufficient to either simplify the request procedure (and thus the cooperation between law enforcement authorities in different countries) or to mutually recognise the validity of requests sent from other countries, provided they meet certain requirements.