Legal Annexe: Overview of Legal Powers
Total Page:16
File Type:pdf, Size:1020Kb
Legal Annexe: Overview of legal powers Digital Rights and Freedoms Vodafone Group Plc Vodafone Group Plc Digital Rights and Freedoms Legal Annexe: Overview of legal powers Contents The content covered in this Legal Annexe was updated following analysis completed in spring 2016. Transparency and the law 3 A–E Albania 6 Australia 11 Belgium 19 Czech Republic 25 DR Congo 30 Egypt 34 F–J France 37 Germany 43 Ghana 51 Greece 54 Hungary 58 India 62 Ireland 68 Italy 74 K–O Kenya 80 Lesotho 85 Malta 88 Mozambique 93 The Netherlands 96 New Zealand 99 P–S Portugal 106 Qatar 110 Romania 112 South Africa 118 Spain 122 T–Z Tanzania 128 Turkey 133 United Kingdom 141 2 Vodafone Group Plc Digital Rights and Freedoms Legal Annexe: Overview of legal powers Transparency and the law This Legal Annexe is produced communications and to block or restrict Law Enforcement Disclosure Statement. In looking at the first area, we focus on the to accompany our transparency access to communications. It also includes a We have chosen to cover this additional three categories of legal power that account disclosures published within new section on laws related to encryption. area because, as we note in our Statement, for the vast majority of all government agency encryption is widely perceived to be an and authority demands we receive and which Compiling this Annexe is a complex task. the Vodafone Digital Rights and important enabler of freedom of expression, are also of greatest interest in the context of Vodafone counsel and the external law Freedoms Reporting Centre. allowing individual citizens to seek and share the current public debate about government firms supporting us in this work have had a information and opinions freely online with surveillance. Those categories are: The Annexe seeks to highlight some of the number of discussions about the meaning confidence that their communications will most important legal powers available to and interpretation of some of the laws that • lawful interception; remain private. At the same time, the rapid government agencies and authorities seeking govern disclosure of aggregated demand • access to communications data; and spread of encrypted devices that cannot be to access customer communications across statistics. Laws are frequently vague or accessed – and communications content that • national security or emergency powers. the 28 countries included within our Law unclear and there is commonly a lack of cannot be read – by law enforcement and Enforcement Disclosure Statement. While the judicial guidance in interpreting the law An explanation of each of these three intelligence agencies is a source of concern legal powers summarised here form part of that exists. Precise interpretation is difficult, categories can be found earlier in the Law for many governments. local legislation in each of these countries exacerbated further (as we highlight in our Enforcement Disclosure Statement. We have and can therefore be accessed by the public, Law Enforcement Disclosure Statement) by also outlined some of the most common in practice very few people are aware of these significant uncertainty on the part of some What this Annexe covers types of legal powers used to demand powers or understand the extent to which they governments themselves, even when we have In this third edition of this Legal Annexe, we assistance from local licensed operators enable agencies and authorities to compel sought guidance from them. focus on three key areas: in the same section. However, we have not operators to provide assistance of this nature. covered other areas, such as the many and During 2016, we worked with Hogan Lovells 1. Laws empowering government agencies The contents of this Legal Annexe do not varied ‘search and seizure’ powers. to update the existing content of this Legal and authorities to demand access to form legal advice and should not be relied Annexe for those countries of operation that customer communications; upon as such. Neither Vodafone nor Hogan had new laws in force, specifically Belgium, 2. Laws empowering government Lovells accepts any responsibility or liability Czech Republic, France, Italy, Kenya, the agencies and authorities to require to any person in relation to this Legal Annexe Netherlands, New Zealand, Australia, the operators to block or restrict access to or its contents. Please see the full Disclaimer Democratic Republic of Congo, Greece, communications; and on page 5. Romania, Spain and Turkey. It is worth noting 3. A new section surveying laws related that at the time of updating the existing Creation of this Annexe to encryption in the context of content (completed in the spring of 2016) law enforcement assistance in the This Annexe has been compiled by our new laws were proposed or pending in several telecommunications sector. legal counsel in 28 countries with support more of our countries of operation including from the international law firm, Hogan Germany, Ghana, Hungary, Ireland, Lesotho, The legal powers summarised in these three Lovells and their network of local law firms. Malta, Mozambique, the Netherlands, South areas are specifically relevant to our local It contains information on the meaning Africa, Turkey and the UK. licensed telecommunications businesses and of some of the most important laws that can usually be found in telecommunications The additional section on encryption is empower government agencies and statutes or in the conditions of the licence intended to help inform what is now an authorities to demand access to customer issued by governments to those operators. intense public debate, as we explain in our 3 Vodafone Group Plc Digital Rights and Freedoms Legal Annexe: Overview of legal powers In looking at the second area, we review three assisted us in preparing the Legal Annexe in Summary of findings operator or communications service further categories of legal powers related to 2014 and 2015) in each country to undertake on encryption provider regarding what is legally censorship that may be used by government a survey of the laws governing encryption in permissible; and The lack of a legal framework related to agencies or authorities to require operators to the context of law enforcement assistance in • there is extensive scope for general law encryption in many countries presented block or restrict access to a communications the telecommunications sector, focusing on enforcement legislation, national security a challenge for the Vodafone local market network, content or services. Those categories three questions: and civil emergency powers and a wide legal teams and external law firms involved in are the: 1. Does the government have the legal array of other laws to be interpreted as undertaking the survey. Rather than rely on authority to require a telecommunications relevant to encryption matters in a manner • shut-down of network or communications definitive legal precedents (very few of which operator to decrypt communications which cannot be predicted. services; exist), our external counsel developed a view data where the encryption in question • blocking of access to URLs and IP of the legal position in each country based Question 2 (‘Does the government have the has been applied by that operator and the addresses; and upon their interpretation of the wording of legal authority to require a telecommunications operator holds the key? • powers enabling government agencies relevant statutes, their understanding of operator to decrypt data carried across its 2. Does the government have the legal and authorities to take control of a existing academic schools of thought and networks (as part of a telecommunications authority to require a telecommunications telecommunications network. known government policy positions. This service or otherwise) where the encryption operator to decrypt data carried Legal Annexe should therefore be read as an has been applied by a third party?’) relates to a An explanation of each of these categories across its networks (as part of a informed but preliminary assessment based significant proportion of the data traffic carried can also be found earlier in our Law telecommunications service or otherwise) on a wide range of inputs. by almost every telecommunications Enforcement Disclosure Statement. where the encryption has been applied by operator worldwide. a third party? The findings of the survey are set out in this It should be noted that the legal powers Legal Annexe. In summary, we found that: This can lead to some challenging situations 3. Can a telecommunications operator described do not provide a comprehensive when a law enforcement agency issues an lawfully offer end-to-end encryption on its • in many countries, there is no legal overview of all powers that could be used to operator with a lawful demand for access communications services when it cannot framework related to encryption block or restrict access to communications to communications data but then discovers break that encryption and therefore could whatsoever; within our countries of operation. For it must approach a third party – often in not supply a law enforcement agency with • in answer to question 1, it is example, we have not sought to catalogue a different jurisdiction – to demand the access to cleartext metadata and content clear in the intent of the law in all court rulings ordering internet service encryption key. The law in many countries of the communication on receipt of a countries (although not necessarily providers or telecommunications operators