EUROPEAN COMMISSION Brussels,17.4.2018 SWD(2018) 118 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters

and

Proposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings {COM(2018) 225 final}



{COM(2018) 226 final}

{SWD(2018) 119 final}



Table of Contents 1.Introduction: Political and legal context 1.1.Introduction 1.2.Political and legal context 2.Problem definition 2.1.What is the problem? 2.1.1. Definition and magnitude 2.1.2. Cross-border dimension 2.1.3. Why is it a problem 2.1.4. Who is affected and how 2.2.What are the problem drivers? 2.2.1. It takes too long to access e-evidence across borders under the current judicial cooperation procedures, rendering investigations and prosecutions less effective 2.2.2. Inefficiencies in public-private cooperation between service providers and public authorities hamper effective investigations and prosecutions 2.2.3. Shortcomings in defining jurisdiction can hinder effective cross-border investigation and prosecution 2.3.How will the problem evolve? 3.Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: necessity of EU action 3.3.Subsidiarity: added value of EU action

4.Objectives: What is to be achieved? 4.1.General objective 4.2.Specific objectives 5.What are the available policy options? 5.1.Scope of policy measures 5.2.Description of policy measures 5.2.1. Non-legislative action 5.2.2. Legislative action 5.3.Measures discarded at an early stage 5.4.Description of the policy options 5.4.1. Option O: baseline 5.4.2. Option A: non-legislative action 5.4.3. Option B: option A + international agreements 5.4.4. Option C: option B + direct cooperation legislation 79 5.4.5. Option D: option C + direct access legislation 6.What are the impacts of the policy options? 6.1.Qualitative assessment 6.1.1. Social impact 6.1.2. Economic impact

6.1.3. Fundamental rights impact 6.2.Quantitative assessment 7.How do the options compare? 7.1.Qualitative comparison 7.2.Quantitative comparison 8.Preferred option 9.How will actual impacts be monitored and evaluated? Annex 1: Procedural information 1.Lead DG, Decide Planning/CWP references 2.Organisation and timing 3.Consultation of the RSB 4.Evidence, sources and quality Annex 2: Stakeholder consultation Annex 2.1: surveys Annex 2.2: meetings Annex 2.3: conferences Annex 3: Who is affected and how? 1.Practical implications of the initiative 2.Summary of costs and benefits Annex 4: Analytical methods

1.Qualitative assessment of policy measures 2.Qualitative comparison of policy options 3.Quantitative assessment of policy measures Annex 5: List of relevant legislation and policies Annex 6: Additional information on the problem drivers Annex 7: Additional information on the policy measures Measure 1: practical measures to enhance judicial cooperation Measure 2: practical measures to enhance direct cooperation Measure 3: multilateral international agreements Annex 8: Additional information on early discarded measures Annex 9: Additional information on the baseline Annex 10: US DOJ proposal on cross-border access to e-evidence Annex 11: Additional data on the size of the problem Annex 12: WHOIS database Annex 13: SME Test280 Glossary Term/Acronym Definition Access logs Access logs record the time and date an individual has accessed a service and the IP address from which the service was accessed Budapest Convention 2001 Council of Europe Convention on Cybercrime Cloud computing Model for enabling convenient on-demand network access to a shared pool of configurable computing resources Connecting factor A fact that connects an occurrence with a particular law or jurisdiction Content data The substance of stored information, such as text, voice, videos, images, and sound Data sharding A type of database partitioning that is used to separate very large databases the into smaller, faster, more easily managed pieces called data shards e-CODEX IT system for cross border judicial cooperation which allows users to send and receive documents, legal forms, evidence etc. in a secure manner ECPA 1986 US Electronic Communications Privacy Act of 1986 E-evidence Electronic evidence:, electronically stored data such as subscriber information, metadata or content data, generated by any activity related to digital services EIO European Investigation Order, as set out in Directive 2014/41/EU ETSI European Telecommunications Standards Institute International Comity The practice of showing courtesy among nations, the disposition to perform some official act out of goodwill and tradition rather than obligation or law IP address Internet Protocol address, a unique identifier allowing a device to send and receive packets of information; a basis for connecting to the internet Judicial authority A judge, a court, an investigating judge or a public prosecutor Loss of location A situation where law enforcement cannot establish the physical location of the perpetrator, the criminal infrastructure or electronic evidence. Metadata Data processed for the purposes of transmitting, distributing or exchanging electronic communications or other content through a network MLA(T) Mutual Legal Assistance (Treaty) Production order An order issued by the competent authority of a Member State to a digital service provider to provide specified electronic evidence Production request A request without a binding effect by the competent authority of a Member State to a digital service provider to provide specified electronic evidence Ransomware A type of malicious software that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid SIRIUS Europol platform to facilitate online investigations, including the direct cooperation between authorities and service providers Subscriber information Information allowing to identify a natural person or legal entity using services provided by relevant service providers TOR 'The Onion Router', an open source software that enables anonymous communication Traffic data Data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof Transaction logs Transaction logs identify products or services an individual has obtained from a provider or a third party (e.g. purchase of cloud storage space) VPN Virtual private network: a technology that creates a safe and encrypted connection over a less secure network, such as the internet WHOIS Reference database for ownership of web site domain names



1.Introduction: Political and legal context

1.1.Introduction Cross-border data flows are rising together with the growing use of social media, webmail, messaging services and apps to communicate, work, socialise and obtain information, including by criminals. An increasing number of criminal investigations therefore rely on electronic evidence that is not publicly available, e.g. information on the holder of an email account, messages exchanged via Facebook messenger or information on the timing of WhatsApp calls. Law enforcement and judicial authorities often experience difficulties in accessing electronic evidence relevant to an investigation. Electronic evidence is increasingly available only on private infrastructures, which may be located outside the investigating country, owned by service providers established outside the investigating country, or both. For such cross-border situations, traditional mechanisms for cooperation between authorities are slow compared to the fast pace at which data can be moved, changed or deleted. In addition, they are under increasing strain with the growing number of cross-border cases. Furthermore, authorities have begun to question whether a mechanism designed to protect the sovereignty of another country is apt for today’s situations where the connection of the crime to the requested country is often limited. In addition, information that is publicly available and easily accessible to law enforcement might move into systems requiring special credentials to access. This development notably concerns the general world-wide lookup tool for owners of web site domain names, known as "WHOIS". Direct cooperation with US service providers has developed as an alternative channel to judicial cooperation, but is limited to non-content data and is voluntary from the perspective of US law. In the face of these developments, a number of countries have begun to explore under what conditions authorities may request access to data using their own domestic tools. The Yahoo! and Skype decisions in Belgium are examples of recent court cases which focus on the legitimacy of the use of domestic production orders for companies whose main seat is outside the requesting country but which provide a service in the territory of that country. The resulting fragmentation may generate legal uncertainty, as well as concerns on the protection of fundamental rights and procedural safeguards for the persons related to such requests. In addition, there have been a number of court cases in the US on whether US authorities have the right to request the production of data stored abroad by a service provider whose main seat is in the US, including notably the “Microsoft Ireland” case . Improving cross-border access to e-evidence is a pressing issue concerning almost any type of crime. In particular, the recent terrorist attacks have underlined the need, as a matter of priority, to find ways to secure and obtain e-evidence more quickly and effectively. 1.2.Political and legal context The Commission committed in the April 2015 European Agenda of Security to review obstacles to criminal investigations into cyber-enabled crimes, notably on cross-border access to electronic evidence. In April 2016 the Commission undertook to propose solutions by summer 2017, including legislation if required. There have been repeated calls for action both from the EU Member States and the European Parliament. The Council supported the Commission´s commitment in its June 2016 Conclusions on improving criminal justice in cyberspace and endorsed a set of practical measures to be taken forward. Specifically, the Council called on the Commission to take concrete actions based on a common EU approach to make mutual legal assistance more efficient, to improve cooperation between Member States’ authorities and service providers based in non-EU countries, and to propose solutions to the problems of determining and enforcing jurisdiction in cyberspace. The Review Report of the 2016 EU-US MLA Agreement, which was finalised at the same time as the Council Conclusions, contained several recommendations to improve access to electronic evidence. In its final report on the seventh round of mutual evaluations on prevention and combating cybercrime , the Council also recommended that the EU and its Member States consider the development of an EU framework on law enforcement access to data held by service providers. President Juncker committed to put forward a legislative proposal in 2018 in his September 2017 Letter of Intent . The European Parliament adopted a resolution on the fight against cybercrime in October 2017 , which acknowledges the difficulties of public authorities in accessing electronic evidence across borders and underlines the need for a common European approach to criminal justice in cyberspace, as a matter of priority. It calls on the Commission to put forward a European legal framework for electronic evidence, including harmonised rules to determine the status of a provider (domestic or foreign), and to impose an obligation on service providers to respond to requests from Member States that are based on due legal process. The legal and policy environment surrounding this initiative is complex because: 1) The initiative touches upon several areas: ·while cross-border access to evidence by public authorities in the framework of criminal investigations is governed by the acquis in the area of judicial cooperation in criminal matters, the initiative also involves exchange of personal data, so the data protection and ePrivacy frameworks are also relevant; ·there are many co-existing levels of regulation: EU law, rules at Member State level governing criminal investigations, international conventions and bilateral agreements. US law also plays an important role, as major service providers holding relevant evidence operate under US jurisdiction. 2) Some aspects of the legal environment are currently subject to changes: ·several EU instruments are currently under revision, such as the ePrivacy Directive, and new proposals are being prepared; ·work has recently started on an additional protocol to the Council of Europe Budapest Convention on Cybercrime, the main international framework governing access to electronic evidence by public authorities; ·like the EU and its Member States, the US is trying to address the issues created by cross-border access to e-evidence through legislative initiatives.

A detailed list of relevant legislation and policy can be found in Annex 5. 2.Problem definition Table 1 shows the intervention logic (problem, drivers, objectives and options) that will be described in detail in the following sections 2 to 5: Problem Problem drivers General objective Specific objectives Options Non-legislative Legislative A B C D Some crimes cannot be effectively investigated and prosecuted in the EU because of challenges in cross-border access to electronic evidence 1.It takes too long to access e-evidence across borders under existing judicial cooperation procedures, rendering investigations and prosecutions less effective 2.Inefficiencies in public-private cooperation between service providers and public authorities hamper effective investigations and prosecutions 3.Shortcomings in defining jurisdiction can hinder effective cross-border investigations and prosecutions Ensure effective investigation and prosecution of crimes in the EU by improving cross-border access to electronic evidence through enhanced judicial cooperation in criminal matters and an approximation of rules and procedures 1.Reduce delays in cross-border access to electronic evidence 2.Ensure cross-border access to electronic evidence where it is currently missing 3.Improve legal certainty, protection of fundamental rights, transparency and accountability Practical measures to enhance judicial cooperation between public authorities and direct cooperation between public authorities and service providers Option A + international agreements Option B + direct cooperation legislation on the European Production Order and access to databases Option C + direct access legislation Table 1: problem, drivers, objectives and options (intervention logic) 2.1.What is the problem? 2.1.1.Definition and magnitude The problem is that some crimes cannot be effectively investigated and prosecuted in the EU because of challenges in cross-border access to electronic evidence. Electronic evidence – which can be relevant for any crime – is often stored outside the country whose authorities need access. Determining the location of the data may be difficult, and even where it is possible, data can be moved quickly and effortlessly. Once a cross-border element is or might be present, authorities have to rely on one of the three channels existing today to access e-evidence across borders: 1.judicial cooperation between public authorities, 2.direct cooperation between a public authority and a service provider and 3.direct access to electronic evidence by a public authority. These channels suffer from a number of shortcomings that can be summarised as follows: ·judicial cooperation is often too slow for timely access to data and can entail a disproportionate expense of resources; ·direct cooperation can be unreliable, is only possible with a limited number of service providers which all apply different policies, is not transparent and lacks accountability; ·legal fragmentation abounds, increasing costs on all sides; and ·the size of the problem is steadily increasing, creating further delays. Figure 1 describes the main parties and channels to access e-evidence across borders today. The main parties are the public authorities requesting access to evidence, the public authorities receiving the request and the service provider that has access to the evidence.





Figure 1: the main parties and the three channels for cross-border access to e-evidence 1. Judicial cooperation (MLA/EIO) 2. Direct cooperation (with service providers) 3. Direct access (to e-evidence) 1)Judicial cooperation ·Judicial authorities of country A contact the competent judicial authorities of the country where the service provider is established, formally requesting through judicial cooperation channels (i.e. MLA request or European Investigation Order, EIO) the evidence to which the service provider has access. ·Within the EU, the legal framework on judicial cooperation for obtaining cross-border access to electronic evidence is the EIO Directive. The EIO, based on mutual recognition of judicial decisions, provides for direct communication between judicial authorities rather than going through central authorities, supported by deadlines, standardised forms and limited possibilities to refuse recognition and execution of requests. ·Judicial cooperation with countries outside the EU is mainly based on international agreements, notably the Budapest Convention. Besides that, there are bilateral agreements concluded by the EU (notably, the Agreement with the United States on mutual legal assistance ) and by the Member States, most frequently with the US, followed by Canada and Australia. 2)Direct cooperation

·In direct request situations, the public authorities of country A directly contact the service provider established in country B with production orders/requests pursuant to national rules of criminal procedure, and request evidence to which the service provider has access, typically data on a user of the services it provides. ·This concerns some service providers established in the US and, to a more limited extent, in Ireland, which reply directly to requests from Member States' law enforcement authorities on a voluntary basis, as far as the requests concern non-content data. ·For WHOIS data, service providers make data directly available to authorities through a centralised search system which does not rely on individually reviewed requests. 3)Direct access ·"Direct access" refers to cases where authorities access data without the help of an intermediary, for instance following the seizure of a device ("extended search") or following the lawful acquisition of login information ("remote search"). The national law in at least 20 Member States empowers authorities, subject to judicial authorisation, to seize and search a device and remotely stored data accessible from it, or to use credentials for an account to access and search data stored under that account. This tool becomes more relevant as data is now regularly stored not on the local device but on servers in a different location, possibly outside of the Member State concerned or even outside of the EU. ·Often, the location of this data is not known to law enforcement (so-called "loss of knowledge of location"), and it may be practically impossible to determine, such as in cases where the data is hosted on Darknet services that use multiple layers of IP relays to disguise their location. As a result, it can be difficult to determine whether such searches have a cross-border component ·Member States have different approaches to direct access and the data storage location (see section 2.2.3). The requesting public authorities, the receiving public authorities and the service provider, and the e-evidence can all be located in different countries. The general problem that figure 1 describes encompasses multiple specific cases depending on whether each of these countries is located in the EU or not: Table 2: mapping of possible situations in cross-border access to electronic evidence Country Comment A Requesting public authority B Receiving public authority and service provider C E-evidence EU EU EU Particular case: A=B=C

(requesting public authorities, service provider and data in the same country ⇨ national issue) EU EU Non-EU Particular case: A=B

(requesting public authorities and service provider in the same country) EU Non-EU EU Particular case: A=C

(requesting public authorities and data in the same country) EU Non-EU Non-EU Particular case: B=C

(service provider and data in the same country) Non-EU EU EU To be taken into account for potential reciprocity considerations Non-EU EU Non-EU Non-EU Non-EU EU Non-EU Non-EU Non-EU Out of scope With regard to the location of the evidence (i.e. country C): ·it is not always known; ·data is volatile and can be moved quickly across borders, so country C can change rapidly, inside and outside the EU; ·data can be split between countries (e.g. data shards, inside and outside the EU); ·there can be copies in multiple countries (inside and outside the EU). Scope of the problem The problem affects all types of data, from basic information about the subscriber to a given service, to logs showing when a specific user or IP address accessed a service, to metadata and content data. They reflect different levels of relevance of the gathered e-evidence: subscriber data is useful to obtain leads in the investigation about the identity of a suspect; access logs can help connect a user to an action; metadata and content data can be most relevant as probatory material. Challenges affect both access to data at rest (stored data) and to data in transit. The problem affects all types of crime that can leave a digital trace: it is relevant for many types of serious crimes, but also for a number of lower-impact, high-volume crimes such as spreading of malicious software (e.g. ransomware), but also when the only digital element is some form of electronic communication. It is relevant for the gathering of evidence for specific and individual criminal investigations and for specific and limited data access, rather than for other purposes that might require bulk data access. Most of the relevant information is held by a number of service providers including electronic communications service providers and information society service providers, providers of internet infrastructure services and digital marketplaces. Both relevant data and relevant service providers could potentially be anywhere in the world, as the relevant services are provided at a distance and are independent of national borders.

In this context, it is important to note that the problems this initiative seeks to tackle have not been created by previous EU instruments. Rather, new technological developments require new answers (and may require them also in the future). The internet is largely privately owned and borderless for everyone except authorities pursuing criminal investigations. States de facto have no control over data as it crosses borders into or from their territory. Accordingly, their purported sovereign interest in maintaining control over any authority's access to that data has been growing more and more limited over time. This fundamental challenge of data moving swiftly across jurisdictions is unrelated to any existing policy but rather a consequence of the business models of service providers that have evolved organically. The data minimisation principle inherent in data protection laws and the lack of data retention obligations also result in less data being available for shorter periods of time. Data protection rules also create requirements that must be satisfied, e.g. as regards user notification (which arise under the GDPR and the Police Directive). Size of the problem It is not possible to determine exactly the number of crimes that cannot be effectively investigated and prosecuted in the EU because of challenges in cross-border access to electronic evidence. Data at this level of detail is not collected by public authorities. There is no precise data available on the number of requests for judicial cooperation, direct cooperation, direct access or WHOIS lookups. For judicial cooperation requests, based on available data on the European Arrest Warrant and from the European Judicial Network, it can be estimated that there are around 13,000 MLA/EIO requests per year on e-evidence between Member States (including all types of data). Also, based the figures collected during the 2016 EU-US MLA Review exercise, it can be estimated that the outgoing requests for e-evidence by EU public authorities to the US authorities amount to approximately 1300 per year (mainly requests for content data). For direct cooperation, the main source of data is the transparency reports that some service providers publish concerning the requests they receive from public authorities. The transparency reports do not distinguish whether the request came directly from the Member State in which it originated (direct cooperation request) or it came from the public authorities of a Member State that was asked to cooperate with the one in which the request originated (judicial cooperation request). They concern mostly requests for non-content data. Given these limitations, the Commission estimated the magnitude of the problem, using two main sources of information: ·a survey addressed to public authorities in Member States ; and ·the transparency reports from the main service providers (Facebook, Google, Microsoft, Twitter and Apple ), which contain information on the number of requests received from public authorities and the percentage of requests fulfilled. The results were broken down in three stages: 1)Percentage of investigations including a request to cross-border access to e-evidence. More than half of all investigations include a cross-border request to access e-evidence. ·E-evidence in any form is relevant in around 85% of total (criminal) investigations. ·In almost two thirds (65%) of the investigations where e-evidence is relevant, a request to service providers across borders (based in another jurisdiction) is needed. ·Combining the two percentages above results in 55% of total investigations that include a request to cross-border access to e-evidence. ·Requests for non-content data outnumber those for content within the EU and beyond. Non-content data from electronic communications is most commonly requested. The transparency reports provide an idea of the number of requests that the above percentages refer to. The figure below shows that the number of requests to the above service providers has increased by 70% in the last 4 years: Figure 2: evolution of number of Member States' requests to the main service providers Other insights from the transparency reports of these providers include (see Annex 11): ·Three Member States, Germany (35,271 requests), the UK (28,598) and France (27,268), accounted for more than 75% of the total number of requests from the EU to the five main service providers in the last year.

·Google and Facebook accumulated more than 70% of the total number of requests from Member States to the five main service providers in the last year. 2)Percentage of requests to service providers that are fulfilled. Less than half of all the requests to service providers are fulfilled. ·The table below summarises the responses to the survey of public authorities in Member States on the percentage of investigations where the request to service providers was fulfilled, using judicial and direct cooperation channels. ·The table shows that the requests for content are comparatively the most difficult to fulfil and the requests for subscriber data the least difficult to fulfil, regardless of whether the requests is within the EU or with non-EU countries. Nonetheless, even the requests for subscriber data remain unfulfilled in a significant percentage of cases, more than half for requests to non-EU countries, which are particularly relevant, as shown in point 1) above. ·The table shows that the requests for access to e-evidence within the EU are comparatively fulfilled more easily than with non-EU countries, regardless of the type of data. Table 3: percentage of requests to service providers that are fulfilled (survey data) Within the EU With non-EU countries Judicial Direct Judicial Direct Non-content data Subscriber data 75% 55% 45% 45% Metadata 60% 45% 35% 35% Content data 55% N/A 30% N/A ·The median of the above responses is 45%. The transparency reports include data on the requests from the Member States that are answered, so it is possible to compare this data with the one from the survey: Figure 3: evolution of the % of requests from Member States answered by service providers ·The graph above shows that the response rate has remained under 50% in the 2013-2015 period and was more than 50% only in 2016. ·The transparency reports contain information on the number of requests answered, which might not be necessarily the same as fulfilled. The percentage of requests fulfilled is likely to be lower than the percentage of requests answered. ·The number of outgoing MLA requests to the US is still much smaller than the number of unsuccessful direct cooperation requests. This means that in case a direct cooperation request is unsuccessful, it is only rarely followed-up by a MLA request. In these situations, the evidence will not be available for the investigation. ·The period 2013-2016 is likely to have shaped the most the perception of public authorities and their responses to the survey. The median of the percentage of requests answered by service providers in the 2013-2016 period is 45%, which is indeed the same estimate obtained in the survey. The transparency reports and the targeted survey to Member States indicate that a request could remain unfulfilled for a variety of reasons, including that the request is sent to a provider who does not hold the data, it is excessively broad or unclear, it fails to specify an (existing) account or sought information, it does not have a valid legal basis or the data sought no longer exists. 3)Percentage of crimes involving cross-border access to e-evidence that cannot be effectively investigated or prosecuted. Almost two thirds of crimes involving cross-border access to e-evidence cannot be effectively investigated or prosecuted. ·The table below summarises the responses to the survey on the percentage of investigations involving requests to access e-evidence across borders that are negatively affected or cannot be pursued:

Table 4: percentage of investigations involving requests to access e-evidence across borders that are negatively affected or cannot be pursued Cause Within the EU With non-EU countries Judicial Direct Judicial Direct Lack of timely access 35% 25% 45% 15% Lack of access (access denied) 25% 25% 25% 15% Other 15% 5% 15% 10% Total 75% 55% 85% 40% ·The table shows that the lack of timely access is more significant when using judicial cooperation channels, in particular with non-EU countries. ·Direct cooperation seems to be a more efficient channel than judicial cooperation, in particular with service providers based in non-EU countries. Since this channel is based on voluntary cooperation, public authorities indicated that they tend to limit their direct cooperation requests to the service providers that they know are willing to cooperate, which might also explain the relatively low percentage of investigations negatively affected. In the rest of the cases, judicial cooperation is the only channel left to request access to data across borders, which might also explain the higher percentage of investigations negatively affected. ·In addition, direct cooperation is typically limited to non-content requests, whereas judicial cooperation includes also content requests, which are more problematic (see the problem drivers in section 2.2.). ·The median of the above responses is 65%: almost two thirds of crimes involving cross-border access to e-evidence cannot be effectively investigated or prosecuted. 2.1.2.Cross-border dimension This initiative covers a variety of crimes with an increasing cross-border dimension. To illustrate this, consider Hans, a German prosecutor who has to deal with cases such as : ·Terrorism: after a terrorist attack in Germany, the German police find connections of the suspect terrorist to a cell that has been involved in other terrorist attacks in France, Belgium and Spain. The suspect has spent time in Syria, Turkey and Morocco. The German police have indications that the terrorists communicated through email drafts: one terrorist drafted an email and instead of sending it, saved it to the draft folder, accessible online from anywhere in the world. The other terrorist opened the same account and read the message. As the email was never sent, it was not possible to track. The Microsoft server hosting the account is in Ireland. Hans prepares an MLAT request to the Irish authorities in order to gather more information about the suspect terrorist’s email account contents. ·Child sexual abuse: after having infiltrated a website for exchanging child sexual abuse material in the Darknet for more than a year, the Australian police have gathered information on more than one million users globally, which they have started to distribute to law enforcement around the world. Some of the child victims appear to be in Germany. The investigation has revealed the offender's Facebook profile; Hans prepares a production request (direct cooperation) to Facebook (based in the US) in order to gather more information about the possible offender's exact location using his Facebook account. ·Human trafficking: a Syrian national is arrested in Germany, near the Austrian border, accused of human trafficking. The suspect was taking advantage of the refugee crisis to facilitate illegal border crossing from Turkey to Germany through the Balkan route (Turkey, Greece, Former Yugoslav Republic of Macedonia, Serbia, Croatia, Slovenia, Austria and Germany). The smart phone of the human trafficker was seized by the German police. It contains not only the contact information of other members of the criminal organisation he belongs to, but also indications that the human trafficker used WhatsApp. Although the WhatsApp conversations were deleted from the phone, a backup exists in the cloud, accessible via the seized mobile device. The German police, under Hans' supervision, directly access these conversations to dismantle the organised crime network. ·Cybercrime: a network of millions of infected computers worldwide is controlled by a central server (a so-called "command and control" server) and used to distribute spam and malicious software, such as ransomware and spyware, on victims' computers. The command and control server moves from one domain to the next every five minutes, without regard to national boundaries. In a first investigative step, Hans and his colleagues search the domain name WHOIS system to obtain information on the owners of the domain names used by the command and control server. Even crimes that may appear as having no cross-border dimension can actually have one because of e-evidence. Consider for example an assault case in which a German national assaults a German victim in Germany. Hans investigates the case and arrests a suspect. A witness has doubts when asked to identify the person arrested, but reports that she saw the perpetrator made selfies of himself and the assaulted victim lying on the ground with his mobile. Hans confiscates the suspect's phone but finds no relevant pictures on the mobile. The suspect had installed Dropbox and had secured it with a password. Hans needs access to those pictures which, he knows, are stored in the US. He prepares an MLA request to the US, as the German legislation does not allow him to access directly that data in the US. In general, crime has an increasing cyber component, and with it an increasingly prominent cross-border dimension. Whereas the data storage location is still considered as a relevant factor to assert jurisdiction, it is determined for the vast majority of cases by the provider alone, on the basis of business considerations. This choice makes cross-border cooperation necessary in cases which may have no other connection across borders. 2.1.3.Why is it a problem The fact that some crimes cannot be effectively investigated and prosecuted in the EU is a problem because it results in criminals enjoying impunity, victims being less protected and EU citizens may feel increasingly threatened by criminal activity. In general, it hinders the accomplishment of an area of freedom, security and justice in the EU. In particular, when some crimes cannot be effectively investigated and prosecuted because of challenges in cross-border access to e-evidence, there are negative consequences at all stages: 1.Before the crime is committed: when electronic evidence is difficult to obtain across borders the perception of impunity is reinforced.

2.While the crime is being committed: when a crime is ongoing and public authorities are investigating it, effective and timely access to electronic evidence can save lives or prevent serious damage. For example, in terrorism cases with hostages or in ongoing child sexual abuse situations, the time that law enforcement requires to get to the victims can determine whether they survive or not. 3.After the crime has been committed: electronic evidence is volatile and can be transmitted, altered or deleted easily. Public authorities therefore need effective and timely access to it to be able to prosecute criminals and prevent future crimes. There are no mandatory data retention rules in the US (where some of the most important service providers are based) or at EU level, since the Data Retention Directive was declared invalid by the European Court of Justice in 2014 . At the same time, data minimisation requirements force service providers to delete data more quickly. This contributes to the volatility of e-evidence and reinforces public authorities' need for timely access in criminal investigations. Timely access is also important as investigations often have to proceed step by step, identifying first leads and then following further indications provided by those leads, which often necessitate repeated, iterative requests for access to electronic evidence across different service providers and jurisdictions. If the first requests are fulfilled slowly, the chances to find any data in response to further requests decrease significantly. 2.1.4.Who is affected and how The following parties are affected by the challenges in cross-border access to e-evidence in criminal matters: ·Society in general: the fact that some crimes cannot be effectively investigated and prosecuted in the EU damages the secure environment and the effective application of the rule of law required for a society to thrive. ·Victims of crime (natural and legal) suffer the negative consequences (e.g. economic, physical, psychological) of a delayed (or even an impossible) investigation and prosecution of the crime they have become victims of. ·Suspects in criminal investigations: the procedures that regulate cross-border access to electronic evidence must provide legal certainty, transparency, accountability and respect of fundamental rights and procedural guarantees of the suspects in criminal investigations. ·Users of the services offered by service providers: the procedures that regulate cross-border access to electronic evidence must provide legal certainty, transparency, accountability and respect of fundamental rights of the users of the services offered by service providers, to the extent that they may become part, inadvertently, of a criminal investigation. ·Service providers: as the parties with access to electronic evidence, they receive requests to access e-evidence from public authorities, either directly or through MLAT procedures. They invest resources in responding to those requests, which can be significant as the number of requests keeps increasing and the framework to regulate cooperation with public authorities has room for improvement. ·Public authorities (judiciary, law enforcement) from the country issuing the request: they require access to e-evidence to investigate or prosecute crimes. Often, electronic evidence is the only significant lead for investigators, so without access to that evidence the investigation may have to be abandoned, with the negative consequences that this brings for the victims, future victims and society at large, due to the perception of impunity and the weakening of the rule of law. Public authorities from the country receiving the MLAT request are also important parties in this process. As MLAT requests are likely to keep on increasing, the improvement of the current procedures is important so that they can fulfil the requests for cooperation in a timely and effective manner. 2.2.What are the problem drivers? The three problem drivers identified are: 1.It takes too long to access e-evidence across borders under existing judicial cooperation procedures, rendering investigations and prosecutions less effective. 2.Inefficiencies in public-private cooperation between service providers and public authorities hamper effective investigations and prosecutions. 3.Shortcomings in defining jurisdiction can hinder effective cross-border investigations and prosecutions. The following sections summarise the analysis of the problem drivers. A deeper and more detailed analysis is available in Annex 6.

2.2.1.It takes too long to access e-evidence across borders under the current judicial cooperation procedures, rendering investigations and prosecutions less effective Judicial cooperation procedures were designed to ensure respect for the sovereignty of foreign countries on whose territory an investigative or enforcement action needed to be performed. Usually there was a substantial connection to that territory. This substantial connection has become increasingly virtual in the context of e-evidence. Sometimes, the data storage location in a server park or the establishment of a service provider is the only factor connecting an investigation to a given foreign country. In many cases, data is no longer stored on a user's device but made available on cloud-based infrastructure for access from anywhere. Service providers do not need to be established or to have servers in every jurisdiction but rather use centralised systems to provide their services. Cross-border requests have multiplied accordingly, resulting in increased delays in responses. At the same time, data minimisation requirements lead to shorter data storage periods for some types of data; delayed requests risk not finding any data left. In parallel, a number of countries are questioning the appropriateness and usefulness of mutual legal assistance procedures in these circumstances, especially when it comes to less sensitive data categories. Some have not invested sufficient resources to keep up with the growth in foreign demand, given that there is no own interest in the relevant investigations and the service is provided out of courtesy to the foreign country. This has further contributed to the delays in responses. Within the EU The EIO Directive, in application since May 2017, covers the gathering and transfer of evidence between Member States, based on mutual recognition of judicial decisions. The EIO Directive provides for deadlines of 120 days (30 days for the executing authority to make a decision on the recognition or execution of the EIO and 90 days to carry out the investigative measure ), which is faster than the MLA procedure. This improvement is still considered insufficient by Member States’ experts for accessing e-evidence in criminal investigations, for which the EIO process would still be too long and therefore ineffective. The time for accessing electronic evidence is a crucial factor in any investigation: 1.In the absence of retention obligations, providers have no incentive to store data – in particular metadata – for longer than necessary. Data storage is a cost factor. 2.The data minimisation principle inherent in data protection rules obliges providers to store data only for as long as it is necessary. 3.Investigations proceed in an iterative manner. In a typical case, an authority might first contact a service provider to obtain an IP address used to access a service, then turn to the internet access provider to determine who used that IP address at the relevant point in time. If the first step takes more than a few days, then the information on who used the IP address will most likely have been deleted already. In certain cases the EIO Directive allows for shorter time-limits. The issuing authority can indicate in the EIO that a shorter deadline is necessary "due to procedural deadlines, the seriousness of the offence or other particularly urgent circumstances" (cf. Art. 12(2)). Article 32(2) provides for a 24-hour deadline to decide on provisional measures. Nevertheless, these shorter deadlines cannot address the specific needs of e-evidence with its high relevance for criminal investigations: the first is an exception rather than the general rule, requiring reasons for urgency in every case, and the second is specifically aimed at preservation of the data only. Preservation of data alone would not solve the issue: timely access is important as outlined above. Requests for mutual legal assistance (currently up to 5000 per year ) and for recognition and execution of the EIO, follow-up correspondence and enquiries for information are often still sent by traditional means, i.e. by post or fax, contributing to the time the current process takes. All Member States participate in the EIO Directive except Ireland and Denmark, which continue to rely on MLA channels . For Ireland, where a number of service providers have their European headquarters, stakeholders have reported an increase in the time needed to access e-evidence, presumably due to the high number of requests to Irish authorities. Since the EIO deadlines do not apply, this increase might continue to grow. The problem to access electronic evidence has become so pressing that despite the imminent entry into force of the EIO Directive, the Council has repeatedly called upon the Commission in 2016 to take action. With non-EU countries The main legal instruments that Member States use to request access to e-evidence stored in non-EU countries are MLA requests. These formal procedures ensure that the right authorities are involved and that appropriate safeguards are taken into account in both countries when there is a sovereign interest of more than one country. The procedures were designed at a time before the internet, when volumes of requests were a fraction of today’s, and are ill equipped to handle today’s numbers. In addition, the legal framework for mutual legal assistance is fragmented and complex: practitioners are faced with a high number of bi-lateral and multi-lateral conventions and have to ensure compliance with the specific requirements of recipient countries’ legal systems that they are often less familiar with (e.g. probable cause in the US, as will be explained below). Box 1: judicial cooperation on e-evidence

Judicial cooperation requires a significant investment on the part of both the requesting and the receiving countries. ·On the side of the requesting country, besides the requirements of the domestic procedural and substantive laws, the specific conditions of the judicial cooperation instruments and the foreign law have to be met; translations need to be obtained, and a significant number of formal approvals have to be granted. ·The receiving authority has to check the validity of the request and the absence of any obstacles under national law, and then use the necessary national tools for enforcement. The receiving country regularly has to make this investment without any own interest in the solving of the case at hand, based on a spirit of mutual cooperation and on the assumption that the same courtesy would be afforded in return by the country that is now requesting, if roles are reversed. However, in particular in cases relating to e-evidence, this balance of mutual legal assistance has become skewed, as the dominant service providers congregate in a small number of jurisdictions. As a result, these countries receive a disproportionate volume of requests that can outnumber their own outgoing requests by a factor of 10, as is the case for the US. The main recipient of MLAT requests from Member States (and from around the world) for access to e-evidence is the US, where the largest service providers are headquartered. This is why the impact assessment focuses on the US situation, but many of the structural problems of MLA cooperation are similar when it comes to other non-EU countries. In many cases, the requests received have little or no connection to the US besides the seat of the service provider. This forces US authorities to provide thousands of full checks for cases, giving them essentially the same attention as domestic cases, in the absence of any specific US interest in the solving of that concrete crime. The MLAT process with the US takes an average of 10 months , which is considered as too much time by all stakeholders. There have been repeated calls for reform within the stakeholder consultation for this initiative and before . There were extensive consultations in the EU and the US to determine the reasons that explain the long duration of the MLAT process. The stakeholders identified the high volume of requests to access e-evidence as the main factor that has put the MLAT system under enormous strain, and has shown its weakness to deal effectively with the current needs. The number of requests has increased 10 fold over the last decade, reaching around 1600 MLA requests from around the world last year, most of which come from the EU. Other reasons that the stakeholder identified are: 1.Quality of the request, which can make the response time vary significantly. The higher the quality, the fewer the iterations required between the two countries, and the faster the process can be. The most common issue is unclear probable cause (e.g. the connection between the criminal activity and the account) for requests for content and other missing information such as the timeframe relevant to the e-evidence sought. 2.Type of request: the requests for content take much longer than the requests for non-content, as the former require higher standards such as proving probable cause and undergo more complex procedures such as search warrant and filtering or data minimisation (review of all the content to determine what is relevant to the offence and can be forwarded to the requesting country). Emergency requests usually can be answered effectively, within 24h. The problem is that authorities in the EU are unfamiliar with the mechanism . 3.Service providers’ internal procedures. The time that a service provider takes to process a request varies depending on its internal procedures. Member State authorities pointed out the lack of transparency of these procedures. 2.2.2.Inefficiencies in public-private cooperation between service providers and public authorities hamper effective investigations and prosecutions Given the limitations of the judicial cooperation channel described above, Member States regularly obtain non-content data through direct cooperation with service providers on a voluntary basis. This option is supported by the US Department of Justice (DOJ) as the preferred one, as evidenced by letters from the DOJ to Member States. Direct cooperation has become the main channel for authorities to obtain non-content data, as both authorities and service providers acknowledged during the consultations, and as reflected by the significant number of this type of requests (more than 120 000 in 2016) . This section analyses the inefficiencies in this type of public-private cooperation, which prevent direct cooperation from being a fully satisfactory solution. Within the EU In close to all EU Member States, the telecommunications framework prohibits national telecommunications providers from responding directly to requests from foreign authorities. In addition, there is no legal framework allowing direct cooperation in other communication sectors. Therefore, it is rare to non-existent and mainly used in emergency situations. Only service providers based in Ireland provide non-content data on a voluntary basis. When public authorities address requests for direct cooperation to US service providers operating in the EU, unless the service providers are based in Ireland, they typically get redirected to the US, where the service provider holds the data or where the management of these requests within the company takes place. With non-EU countries Given the inefficiencies of the current MLA procedures, the 2016 Review Report of the EU-US MLA Agreement encouraged Member States to cooperate directly with US service providers in order to secure and obtain e-evidence more quickly and effectively. This approach is actively supported by US authorities, as mentioned above. The US law that allows US based service providers to cooperate directly with European public authorities with regard to non-content data is section 2701(2) of the Electronic Communications and Privacy Act 1986 (ECPA) . This cooperation is voluntary . Thus, providers have created their own policies or decide on a case-by-case basis on whether and how to cooperate. The analysis below reflects the main concerns raised by stakeholders from their various perspectives. It necessarily abstracts from companies' individual policies and procedures and may therefore not apply to all situations in an identical manner . Stakeholders expressed general and practical concerns:

·General: 1)transparency of the process; 2)reliability of stakeholders; 3)accountability of stakeholders; 4)admissibility of evidence; 5)unequal treatment of Member States; 6)reimbursement of service providers’ costs; ·Practical: 7)for authorities, how to identify and contact the relevant service provider; 8)for service providers, how to assess authenticity and legitimacy of requests. Annex 6 contains a detailed analysis of each of these concerns. 2.2.3.Shortcomings in defining jurisdiction can hinder effective cross-border investigation and prosecution The previous two drivers have shown, respectively, the challenges that the judicial cooperation and direct (voluntary) cooperation with service providers present for Member States when trying to access e-evidence across borders. These challenges prevent these channels from working properly and being sufficient to address the current needs. In the face of these challenges, Member States have developed two mechanisms to define their jurisdiction over the e-evidence and try to access it across borders: 1)Domestic production orders, in which the Member State asserts jurisdiction through various connecting factors over the data held by a service provider and mandates it to release the data. 2)Direct access to data, in which the Member State asserts jurisdiction over data for which it is not possible to determine its location, and accesses it directly from an information system within its territory, without the assistance of an intermediary (e.g. a service provider or other public authorities). These measures are partially grounded in the conviction, apparent throughout the expert consultations, that a case presenting no links to the country/countries where the service provider has its main seat or where it has chosen to store the relevant data does not necessitate (full) involvement of that country's authorities.

1)Domestic production orders: connecting factors A fundamental challenge highlighted by stakeholders across all three channels to access electronic evidence lies in the fact that stakeholders and legal frameworks disagree as to what constitutes a "cross-border" situation, which makes it difficult to determine when a country can exercise jurisdiction. Based on the results of a questionnaire to Member States, the most common connecting factors used include: ·the storage or processing location of the data (i.e. where the infrastructure used for the storage or processing of the data is located) . While most Member States’ laws attach importance to the storage location of the data, this has proven very difficult in practice as a connecting factor (e.g. while Facebook operates a large data centre in northern Sweden, Sweden has always been asked to send its request to Facebook’s headquarters in the United States). As a result, there has been a trend to move away from data storage location in several Member States and internationally . This is also the preliminary result of a global multi-stakeholder exercise to determine principles for cross-border access to data ; ·the location of the seat of a service provider; ·the place where a service provider has any another establishment; ·the place where a service provider is offering services ; Other connecting factors that have been considered include the nationality of the suspect and the nationality of the victim . The use of different connecting factors not only creates legal uncertainty for authorities, but also for service providers receiving the requests. In particular, service providers active in multiple countries highlighted during the consultations conflicting regulations of those different countries. It is not always obvious to the service providers which legal regime applies and at times the service providers might be unable to produce data due to conflicting laws between countries . As a result, service providers called for a more streamlined process, facilitating lawful access to data in ways that ensure protection of fundamental rights, and reducing situations where they are faced with conflicting rules . As it is unclear to what extent a service provider is obliged to respond to a request based on different connecting factors, the legal uncertainty may also interfere with rights of the persons to which the requested evidence relates, including their right to privacy. A number of legislative instruments even employ different connecting factors depending on the type of e-evidence, usually granting larger domestic competences for non-content data than for content data. At the same time, there is no common understanding of how to categorise the specific types of e-evidence. For example, while some service providers consider the IP address used at the time of creation of an account as basic subscriber information, others view it as transactional data. Other types of electronic evidence for which no legal definitions are available may also be of relevance for criminal investigations, including data unrelated to communications. All of these categories may contain personal data . The absence of certainty as to which data category applies can lead to an uneven application of procedural safeguards, as legal procedures and safeguards vary across different categories of e-evidence. It may also result in conflicts of law as regards the scope of measures. At a more practical level, it may lead to misunderstandings between requesting authority and executing authority or service provider addressed. In general, the use of different connecting factors in different countries can be an obstacle to cross-border investigations and prosecutions and create tensions between countries. The use of different connecting factors and the resulting challenges led the Parties to the Council of Europe Budapest Convention on Cybercrime to initiate discussions on an additional protocol to the Convention (see policy measure 3 in section 5). Although the use of the approaches outlined above to address cross-border situations may provide for a domestic legal mandate for direct cooperation of a service provider, it does not necessarily provide for effective means to oblige a service provider to execute it. Despite a few court decisions about the obligations of service providers, execution in case of non-compliance remains a challenge unless the service provider is established in the relevant country. National authorities rely on conventional enforcement mechanisms, including issuing fines and criminal penalties at national level where non-compliant service providers are located in another country. They also may rely on the country where the relevant service provider is established to ensure the execution of the domestic production order, using MLAT, which contradicts the original intention behind the use of a domestic production order (i.e. to be an alternative to MLAT procedures). For the specific case of WHOIS data that is made available by service providers through a credentialed-access system, domestic legislation might not provide for this possibility. Stakeholders highlighted the importance of swift access for investigative purposes. One head of a Member State national cybercrime unit estimated that his team alone makes around 50,000 WHOIS look-ups per week. Box 2: The Domain Name WHOIS System The term "WHOIS" refers to a system of databases that provide information on who owns a domain name. Every year, millions of individuals, businesses, organisations and governments register domain names. Each one must provide identifying and contact information which may include: name, address, email, phone number, and administrative and technical contacts. A large part of the WHOIS is currently publicly available, e.g. via WHOIS.icann.org , but a number of registries already operate closed systems using credentialed access. In the course of ensuring compliance with data protection principles, this trend is likely to expand to the remaining WHOIS system (see Annex 12). 2)Direct access to data: asserting jurisdiction

For direct access to e-evidence, public authorities require no technical help from a service provider or other public authorities. Data is now regularly stored not on the local device but on servers in a different location, possibly outside of the Member State concerned or even outside of the EU, possibly using dynamic storage systems and rotating locations. Often, it is neither feasible nor possible for an authority to determine the location of the data (i.e. "loss of knowledge of location" or “loss of location”). Box 3: What is loss of location and why does it matter? “Loss of location” refers to a situation where law enforcement cannot establish the physical location of the perpetrator, the criminal infrastructure or electronic evidence. In the case of data, the growing use of cloud-based storage and services means that data stored in the cloud could be physically located in different jurisdictions . Furthermore, recent trends such as the Darknet have contributed to facilitate hiding data location . In these situations, when law enforcement has access to the data without knowing its precise location, there can be a risk of losing it as it may be moved or deleted. Also, when the data subject is made aware of the investigation, as is typically the case for an open search measure, he or she can delete the data from another device within seconds. In addition, the circumstances of a particular investigation may not allow timely determination of the location of infrastructure for the storage or processing of e-evidence, for instance in emergency situations. Based on the responses to a questionnaire (targeted survey 1), Member States have developed or considered two types of direct access to e-evidence: 1)Extended access, i.e. use of a device of a suspect or witness seized as part of an investigation (e.g. with a search and seizure warrant) to access the data accessible from the device (which can include the cloud). Most Member States allow their public authorities to carry out this type of direct access. 2)Remote access to data with lawfully obtained credentials, i.e. a search from an authority's computer, usually not disclosed to the target until later. Only a few Member States allow their authorities to perform remote searches, although the number is increasing. Remote searches are often relevant in the context of investigations on the dark web, where there are no legitimate service providers whose cooperation could be obtained. Although the use of extended or remote access as an investigative measure can be strictly domestic in nature, a cross-border situation is likely, e.g. where the infrastructure used for the data processing or the provider are in another country. The expert consultation process found that Member States have adopted different approaches to balancing the need for effective investigations of crime and possible extraterritoriality: ·when the storage location is unknown, (i.e. when there is loss of location and it is not possible to determine whether access to data would have a cross-border component), several Member States assume that the direct access takes place in a purely domestic context and permit securing the data, e.g. by copying it ; other Member States take the opposite approach and assume that the data is elsewhere and that access may have an effect in another country (although the data might in fact be domestically available) . They will use an MLA request if able to identify the correct country. ·when the storage location abroad is known, a few Member States allow their authorities to access the data stored remotely regardless of the place of storage ; several Member States access the data and contact or notify the authorities of the other country before deciding on how to proceed with the data ; and other Member States do not access the data directly and use formal or direct cooperation channels . ·Member States also have different approaches to conditions and safeguards. While all require judicial authorisation, conditions vary and can include a limit to cases of specific, e.g. serious forms of crime, reasonable grounds to assume that traces of a criminal act may be found on the device. These conditions also extend to the actions permitted: while all Member States permitting direct access allow for copying of the evidence, in some countries data may not be removed or only in exceptional cases. While this diversity may reflect different legal cultures, it becomes an issue when a Member State allows its authorities to access data in a way that is perceived by another State as affecting its sovereignty/territoriality. Moreover, the level of rights of the persons whose data is accessed also varies considerably. In general, these different approaches to direct access in different countries may hamper investigations and prosecutions. 2.3.How will the problem evolve? The main factors that will determine the evolution of the problem are the exponential growth of electronic data, the increasing need to access e-evidence across borders and changing systems for accessing data that would require updates to legislation. 1) The exponential growth of electronic data. The digital age has brought exponential growth of electronic data: Figure 4: estimated worldwide data storage in zettabytes (trillions of gigabytes) Zettabytes Source: OECD

This exponential nature not only brings exponential possibilities for economic and social development but also for crime, in two ways: ·Directly: all things being equal, cybercrime will continue to generate important economic benefits for criminals, justifying the amount of research and development hours required to produce malware, the main tool to carry out cybercrime (every day, more than 300,000 new malware samples are detected) . The data related to cybercrime becomes electronic evidence that public authorities would need to access. ·Indirectly: by 2020 it is expected that up to 50 billion new devices (cars, homes, medical devices, buildings, mobile phones, dishwashers, toys…) could be connected to the Internet . This “Internet of Things” will generate massive amounts of information, which will translate into electronic evidence in the crimes that involve these devices and their users. 2) The increasing need to access e-evidence across borders. As more and more countries join the technology revolution and more people around the world get connected to the Internet, the need to access e-evidence across borders will increase. Globalisation also implies globalisation of criminal evidence. Furthermore, the Internet does not only provide training materials to commit cybercrime or other crimes but also the necessary tools to commit crimes through the crime-as-a-service model . More people connected unfortunately also means more potential criminals that could take advantage of those training materials and tools, likely at a low risk, as the challenges to cross-border access to e-evidence would remain untackled. 3) Changing systems for access that require updates to legislation (see Annex 12). WHOIS data that was formerly publicly available is increasingly moving into systems that prevent unauthorised access by granting logins to legitimate users only, for individual look-ups in the context of criminal investigations. While authorities are considered as legitimate users and therefore would be granted access to the systems, this is only part of the picture. From an authority's perspective, any action needs to have a basis in law, and many national laws, including those of EU Member States, do not provide for one. In the absence of a specific legal basis, the database lookup might have to be replaced by a request or production order for each lookup. In the absence of EU intervention, the problem drivers are likely to evolve as follows: 1. Too much time would still be required to access e-evidence across borders under the judicial cooperation procedures, reducing the effectiveness of investigations and prosecutions. The exponential growth in electronic data will likely cause the number of request to continue increasing. If no action is taken to preserve the ability of authorities to perform WHOIS look-ups, these lookups may have to take the form of individualised requests that need to be reviewed individually. Given that such a lookup is often the first step in an investigation, a conservative estimate would put the number in the tens of thousands per week across the EU. In the absence of a legal basis permitting direct lookups, this procedure would significantly slow down investigative measures: the number of resources to deal with the requests throughout the process is not likely to increase accordingly (e.g. in MLAT requests to the US, public officials from requesting authorities, US Department of Justice officials, US judges and court officials, FBI agents, service providers’ staff). This would likely result in even longer response times to MLAT (and EIO) requests. At the same time, data minimisation requirements force service providers to delete data more quickly, increasing the number of cases where data will no longer be available when the request reaches the service provider. The 2016 Review Report of the EU-US MLA Agreement concluded that there was no need to revise the Agreement, but included recommendations to make the Agreement work better in practice, including on electronic evidence. These include recommendations to seek direct cooperation from US service providers and consider other means to reduce the pressure of the volume of MLA requests to the U.S. for e-evidence, and to train and build capacity for public authorities, including on emergency procedures. The Commission has been encouraging Member States to implement the recommendations contained therein, and is helping to set up training (which is one of the practical measures proposed here), but practitioners and Member States agree that these recommendations are not sufficient to address the issues linked to the access to electronic evidence. Similarly as for the EIO, this is based on the consideration that without a fundamental change of the process, MLA procedures will never be as fast as direct cooperation channels. Emergency procedures are reserved for exceptional situations (involving imminent risk of serious injury or death, including in terrorism cases), while electronic evidence is required in a large proportion of all investigations. 2. Inefficiencies in public-private cooperation between service providers and public authorities would continue hampering effective investigations and prosecutions. As the response times for MLA (and EIO) requests would continue growing, public authorities would increasingly try to reach out directly to service providers, while these would be receiving more and more formal requests simultaneously. Without a clear framework for direct cooperation between service providers and foreign public authorities it is likely that investigations and prosecutions involving e-evidence would become more and more challenging. 3. Shortcomings in defining jurisdiction would continue hindering effective cross-border investigation and prosecution. In the absence of EU intervention, the use by criminals of encryption, anonymisation tools, virtual currencies, the Darknet and other future technologies, or simply the use by service providers of technologies to manage the data that prevent its precise localisation, would continue making it difficult for public authorities to establish the appropriate jurisdiction. This may lead to the adoption by Member States of national legislation on direct cooperation with service providers, on direct access to e-evidence, or on other options such as data localisation, which would lead to a fragmented legal framework that could likely hamper effective cross-border cooperation in investigations and prosecutions. The evolution of the problem in the absence of EU intervention will be further analysed when describing the baseline option. 3.Why should the EU act? 3.1.Legal basis The legal bases for EU action are Articles 82(1), 82(2), 53 and 62 of the Treaty on the Functioning of the European Union (TFEU): ·Article 82(1) specifies that judicial cooperation in criminal matters shall be based on the principle of mutual recognition. This legal basis would cover possible legislation on direct cooperation with service providers (see options C and D), in which the authority in the issuing Member State would directly address an entity (the service provider) in the executing State and even impose obligations on it. This would introduce a new dimension in mutual recognition, beyond the traditional judicial cooperation in the Union, so far based on procedures involving two judicial authorities, one in the issuing State and another in the executing State.

·Article 82(2) would cover possible legislation on direct access (see option D), which would notably establish minimum safeguards and conditions when it comes to cross-border access to data that will protect the rights of subjects whose data is accessed. ·Articles 53 and 62 would provide for the adoption of measures for the coordination of the provisions laid down by law, regulation or administrative action in Member States concerning establishment and provision of services. Specifically, an obligation to appoint a legal representative for the Union would contribute in particular to the elimination of obstacles to the freedom to provide services. 3.2.Subsidiarity: necessity of EU action A satisfactory improvement of cross-border access to electronic evidence in criminal investigations cannot be sufficiently achieved by Member States acting alone or in an uncoordinated way. In the absence of EU action, Member States would have to update their national laws to respond to current and emerging challenges with the likely consequence of further fragmentation and/or conflicts of law, which would likely hamper cross-border cooperation in criminal investigations and prosecutions. Such individual action would also fail to provide a unified system for direct cooperation with service providers, leaving them to deal with more than 20 different legal systems instead of one harmonised approach. Both the Member States and the European Parliament have recognised that these challenges require action beyond the national level. The June 2016 Council Conclusions gave a strong mandate to the Commission, and the October 2017 European Parliament Resolution also called for the Commission to put forward legislative proposals. This makes sense in view of the negative consequences of unilateral actions by Member States: if each Member State were to continue or start its own individual approach, then this would further increase the diversity of approaches and lead to possible conflicts related to the different conditions and safeguards for access. For the access to e-evidence through online databases such as WHOIS, Member States have recently highlighted its importance in November 2017 Council Conclusions, where they cited "the importance of ensuring a coordinated EU position to efficiently shape the European and global internet governance decisions within the multi-stakeholder community, such as ensuring swiftly accessible and accurate WHOIS databases of IP-addresses and domain names, so that law enforcement capabilities and public interests are safeguarded" . Given that the cross-border aspect cannot be sufficiently addressed by unilateral measures, access to the WHOIS database requires EU action because it also concerns cross-border access to non-public data. Such access creates international legal issues that are difficult to deal with by national legislation, which can by its nature only address national issues. Therefore the EU is well-placed to provide a harmonised solution, even if the ideal solution for any such problem would be at the global level, which is currently unrealistic to achieve and will likely remain so for a while. EU action is needed on direct access because the systems adapted by various Member States are not coherent and risk creating conflict among Member States: while some impose few limitations on access to data stored abroad, others demand that law enforcement be able to prove that the data is stored in country out of respect for other countries' sovereignty. This impasse cannot easily be bridged at national level but only through coordinated action to define the conditions under which access may be granted. As described in section 2.3., the current challenges to access e-evidence across borders are likely to keep increasing due to the exponential growth of electronic data, the increasing need to access e-evidence across borders and changing systems for accessing data that would require updates to legislation, as the world becomes more and more interconnected online. EU action to address these increasing challenges is not only necessary but also keenly expected by stakeholders, as repeatedly conveyed during the consultations, and at political level. 3.3.Subsidiarity: added value of EU action Given the cross-border nature of the problem, the diversity of legal approaches, the number of policy areas concerned by the matter (security, criminal law, fundamental rights including data protection, economic issues) and the large range of stakeholders, the EU seems the most appropriate level to address the identified problems. As previously described, the crimes in which electronic evidence exists frequently involve situations where the victim, the perpetrator, the infrastructure in which the e-evidence is stored and the service provider running the infrastructure are all under different national legal frameworks, within the EU and beyond. As a result, it can be very time consuming and challenging for single countries to effectively access e-evidence across borders without common minimum rules. The creation of EU cooperation mechanisms in criminal matters also reflects the value of action at EU level in this area. These mechanisms include legislation, such as the EIO Directive and institutions such as Eurojust. The added value of these initiatives in helping Member States access e-evidence across borders was acknowledged multiple times during the stakeholder consultations. Another important added value of EU action is to facilitate cooperation with non-EU countries, in particular with the US, given that the need to access e-evidence internationally frequently goes beyond EU borders. This cooperation can also be better achieved at EU level than through bilateral agreements of individual Member States. The objectives of the initiative can also be tackled at international level through instruments such as the Budapest Convention, where negotiations on a second additional protocol addressing e-evidence issues are taking place at the moment. A new set of rules at international level would be an essential but not sufficient element in addressing the issues identified; it would not in itself address the problems identified as effectively as it might in combination with an EU instrument. This is due to expectation that the protocol, first, will not be as far-reaching as it is not based on the same level of mutual trust among the more diverse 50+ parties to the Convention and, secondly, will lack the enforcement mechanisms that EU law has, as it is an international Convention. EU action is therefore necessary. 4.Objectives: What is to be achieved? 4.1.General objective The general objective is to ensure effective investigation and prosecution of crimes in the EU by improving cross-border access to electronic evidence through enhanced judicial cooperation in criminal matters and an approximation of rules and procedures. This general objective is in line with the legal basis contained in Article 82(1) TFEU on judicial cooperation in criminal matters, and in Article 82(2) TFEU, which empowers the EU to establish minimum rules concerning mutual admissibility of evidence and the rights of individuals in criminal proceedings to the extent necessary to facilitate mutual recognition of judgements and judicial decisions and police and judicial cooperation in criminal matters having a cross-border dimension. The general objective addresses the general problem of some crimes not being able to be effectively investigated and prosecuted in the EU because of challenges in cross-border access to electronic evidence. 4.2.Specific objectives

There are 3 specific objectives that address the problem drivers identified in section 2.2.: Table 5: problem drivers, specific objectives and general objective Problem drivers Specific objectives General objective 1.It takes too long to access e-evidence across borders under existing judicial cooperation procedures, rendering investigations and prosecutions less effective 2.Inefficiencies in public-private cooperation between service providers and public authorities hamper effective investigations and prosecutions 3.Shortcomings in defining juris-diction can hinder effective cross-border investigation and prosecution 1.Reduce delays in cross-border access to electronic evidence 2.Ensure cross-border access to electronic evidence where it is currently missing 3.Improve legal certainty, protection of fundamental rights, transparency and accountability Ensure effective investigation and prosecution of crimes in the EU by improving cross-border access to electronic evidence through enhanced judicial cooperation in criminal matters and an approximation of rules and procedures 5.What are the available policy options? The following process was applied to determine the policy options: 1)mapping of possible policy measures: a.The mapping covered the full spectrum of possible EU intervention: no action, non-legislative action and legislative action. b.Given that the issue at hand is basically a regulatory failure, it was important to lay out the full range of regulatory tools to determine the most proportionate EU response. c.The mapping stage included a first filter to identify the policy measures to discard at an early stage (section 5.3.). d.The outcome of the mapping stage was a set of policy measures retained for further elaboration and analysis. 2)description of policy measures retained in the mapping stage (section 5.2.);

3)analysis of the policy measures retained in the mapping stage (Annex 4): a.This stage included a second filter to identify the policy measures to discard (i.e. the European Production Request and Order, the European Production Request and the recommendation on conditions and safeguards for cross-border online searches). b.It includes a qualitative analysis using the same assessment criteria as those used to analyse the options. The policy measures retained are therefore those that provide the alternatives that are most feasible (legally, technically and politically), coherent with other EU instruments, effective, relevant and proportional to tackle the problem and its drivers analysed in section 2. c.The outcome of this stage was the final set of measures for the policy options; 4)description of policy options, formed by combining the retained measures into different groups: a.The formation of options follows a cumulative logic, with an increasing level of EU legislative action (section 5.4.). b.The cumulative logic was followed not only because the measures are in general not mutually exclusive and can be combined but also because they are complementary in a number of ways, presenting synergies that the combined options can benefit from. 5)analysis of policy options: a.The options are analysed in detail in sections 6 (impacts), 7 (comparison of options) and 8 (preferred option). 5.1.Scope of policy measures The scope of the policy measures for this initiative is the following: ·Data (material scope): oTypes of data : §Non-content data: ·Subscriber data, which allows the identification of a subscriber to a service. Examples: subscriber’s name, address, telephone number. ·Metadata, which relates to the provision of services and includes “electronic communication metadata”, as defined in the ePrivacy proposal. Examples: data relative to the connection, traffic or location of the communication. ·Access logs, which record the time and date an individual has accessed a service, and the IP address from which the service was accessed; ·Transaction logs, which identify products or services an individual has obtained from a provider or a third party (e.g. purchase of cloud storage space). §Content data. Examples: text, voice, videos, images, and sound stored in in a digital format, other than subscriber or metadata.

The type of data may imply different treatment by existing rules and different procedures to access it. Each of the above categories may contain personal data, and are thus covered by the safeguards under the EU data protection acquis, but the intensity of the impact on fundamental rights varies between them, in particular between subscriber data on the one hand and metadata and content data on the other. Appropriate safeguards need to be provided in accordance with the level of sensitivity. The sensitivity of the data can also depend on the volume requested; large volumes of specific types of metadata can allow for the profiling of individuals, especially with respect to location, and hence require more safeguards as compared to smaller amounts or different kinds of metadata. The above categories are all relevant for different purposes. Leaving any of them outside the scope would greatly diminish the effectiveness of the initiative. oStored vs intercept: §All the data above refers to electronically stored data that already exists. §Intercept data (i.e. data from real-time interception of telecommunications) is out of the scope of this initiative as there are specific and significantly different rules that determine access to that data (see measures discarded at an early stage, section 5.3.). oConcrete criminal offence vs mass surveillance: §This initiative concerns cross-border access to e-evidence in the framework of criminal investigations or criminal proceedings for concrete criminal offences, which ensures the application of procedural guarantees. §Other situations not linked to a concrete investigation, such as intelligence or mass surveillance, are out of scope. oAll data areas are within the scope of the initiative. oTypes of crimes: §All crimes in the areas within the scope of the initiative are covered. The initiative is not limited to serious crimes, as the problem of cross-border access to e-evidence in criminal investigations is relevant for all crimes. ·Providers of the following services (personal scope): oelectronic communications services as defined in the proposal for a Directive establishing the European Electronic Communications Code. The revised definition of electronic communications services covers both traditional telecommunication services (example: voice telephony, SMS, internet access service) as well as new internet-based services enabling inter-personal communications such as voice over IP, instant messaging and web-based email services (Over-the-Top communications services, 'OTTs'). These OTTs are in general not subject to the current EU electronic communications framework (i.e. Directive 2002/21/EC), including the current ePrivacy Directive, which in general applies only to traditional telecommunication services. In line with the expansion of the EU electronic communications and ePrivacy framework, OTTs should be covered by this initiative as well (e.g. Gmail, WhatsApp); oinformation society services as defined in the Directive 98/34/EC that store data at the individual request of a recipient of a service; this includes a variety of known services providers such as social networks (e.g. Facebook and Twitter), cloud services (e.g. Microsoft, Dropbox or Amazon Web Services), online marketplaces (e.g. eBay or Amazon marketplace) or other hosting service providers (e.g. Bluehost). ointernet infrastructure services such as IP address providers and domain name registries and registrars and associated privacy and proxy services (e.g. GoDaddy). Service providers include both data controllers and data processors, as defined in Article 4(7) and 4(8) respectively of the General Data Protection Regulation. ·SMEs: oSMEs are also among the service providers covered. For effectiveness reasons, no general exemption for SMEs from the scope is proposed (see Annex 13).

·Geography: oAll situations described in table 2 and figure 1, except the one in which countries A, B and C are outside of the EU (or A=B=C, in which case it is a national issue). oIn particular, the initiative covers data regardless of where it is stored. oThe initiative takes into account situations where the requesting public authority is from a non-EU country only with regard to reciprocity considerations. 5.2.Description of policy measures The following sections summarise the description of the policy measures. More detailed descriptions are available in Annex 7. 5.2.1.Non-legislative action Measure 1: practical measures to enhance judicial cooperation This measure would address problem driver 1 by making procedures for judicial cooperation more efficient, and specific objectives 1 and 2. a) Judicial cooperation with the US (MLA) The expert consultation process identified the following practical measures to enhance judicial cooperation between public authorities in the EU and the US, on the basis of the existing mutual legal assistance procedures: 1)Organise regular technical dialogues with the US Department of Justice to continue to improve the process, speed and success rate of MLA requests. 2)Facilitate regular contacts between the EU Delegation to the US, the Commission and liaison magistrates of Member States in the US to discuss MLA process issues. 3)Provide opportunities for the exchange of best practice and further training for EU practitioners on applicable rules in the US relate to the MLA procedure. The Commission has made available EUR 500 000 under the Partnership Instrument for this. b) Judicial cooperation within the EU (EIO) This measure proposes to facilitate the implementation of the EIO Directive through a set of measures that could improve the speed of judicial cooperation requests within the EU: 1)An electronic user-friendly version of the forms in the annexes of the EIO Directive. 2)A secure online platform for electronic exchanges of EIO/MLA requests and replies between EU competent authorities (including on e-evidence) to allow for swift and secure exchanges of requests between competent authorities of different Member States. Measure 2: practical measures to enhance direct cooperation

This measure would address problem driver 2 by making procedures for public-private cooperation more efficient. It would address the specific objectives 1 and 2. 1)Creation of single points of contact (SPOC), both on the public authorities’ side and on the service providers’ side: ·On the public authorities’ side in the Member States, it could significantly improve the direct cooperation between those authorities and service providers by e.g. ensuring the quality of outgoing requests and building relationships of confidence with providers, as they know their counterpart. ·On the service provider's side, the creation of a single point of entry could also improve the direct cooperation between those authorities and service providers, by, e.g., helping to clarify the provider’s policies. 2)Streamline procedures on both the public authorities’ and the service providers’ side: ·On the public authorities’ side, the standardisation and reduction of forms used by law enforcement and judicial authorities could facilitate the creation of requests by law enforcement and increase the confidence of service providers when it comes to the identification of authorities and proper forms used. ·On the service providers’ side, significant improvements could be made through streamlining service providers' policies to reduce the heterogeneity of approaches, notably regarding procedures and conditions for granting access to the requested data. 3)Provide opportunities for the exchange of best practice and training of public authorities in the EU on cooperation with US-based providers. ·All stakeholders indicated that additional training for law enforcement and judicial authorities could support the functioning of direct cooperation between those authorities and service providers. The Commission has made available EUR 500 000 under the Partnership Instrument for improving direct cooperation. ·Several stakeholders suggested the establishment of an online information and support portal at EU level to provide support to investigations, including information on applicable rules and procedures. It could leverage the work of existing initiatives such as Europol's SIRIUS platform to facilitate online investigations, including the direct cooperation between authorities and service providers . 5.2.2.Legislative action International agreements The EU could seek to conclude international agreements coherent with EU-internal solutions to provide a basis for closer international cooperation with safeguards comparable to those of the EU-internal solution with regard to individuals' rights, including judicial redress. These agreements could cover judicial cooperation, direct cooperation and/or direct access. The objectives of these measures on improving cross-border access to electronic evidence through international agreements are: ·to ensure international comity; ·to ensure appropriate conditions and safeguards; and ·to institute mutually compatible approaches and reduce conflicts of law. Box 4: what is international comity and why does it matter? International comity is the practice of showing courtesy among nations. It refers to the disposition to perform some official act out of goodwill and tradition rather than obligation or law. In other words, it is the acceptance or adoption of decisions or laws by a court of another jurisdiction, either foreign or domestic, based on public policy rather than legal mandate. In the area of cross-border access to e-evidence, international comity may be challenged when different countries use different connecting factors or direct access. For example, country A may perceive an action by country B as having a cross-border dimension affecting its territorial interests while country B regards the situation as purely domestic in nature; both countries will thus also disagree on the need to use domestic or cross-border channels to obtain the evidence concerned .

These measures consider the negotiation of two types of international agreements: multilateral and bilateral. Measure 3: multilateral international agreements This measure would seek to address problem drivers 1 and 3 by reducing the need for judicial cooperation and clarifying jurisdiction for investigative measures. It would also address problem driver 2 insofar as a multilateral agreement would include provisions on direct cooperation with service providers. All specific objectives would be addressed. Multilateral international agreements ideally create a common framework across a wide number of countries affected by the same challenge. In the field of cyber-enabled crime, the 2001 Council of Europe Convention on Cybercrime (the Budapest Convention) is the main multilateral framework . The parties to the Budapest Convention recently decided to negotiate an additional protocol to the Convention by September 2019 . The scope may expand the existing framework allowing for direct cooperation with service providers in other jurisdictions (possibly including subscriber information, preservation requests, and emergency requests), as well as create a clear framework and safeguards for cross-border access to information. The interest for the EU to follow closely the negotiation of this Additional Protocol is threefold: 1)Some non-EU countries which are also Parties to the Budapest Convention (e.g. the US) are very important in improving cross-border access to e-evidence. 2)While the scope is unlikely to extend to content data, it may include elements that are already covered by existing acquis at EU level, including on Mutual Legal Assistance or in relation to the European Investigation Order. 3)It may help address some of the reciprocity issues that a possible EU legislative initiative could generate (see option C, in particular Box 5). The negotiations are closely linked with a possible EU proposal on e-evidence: if a proposal is made, consistency will have to be ensured, and there will also be a clear competency for the EU and obligation for the Member States to defend a common position. Whereas these negotiations will proceed regardless of EU action, the EU has the option to take a more or less active role in them. The main added value of an EU mandate to take an active role in these negotiations would be to ensure coherence and complementarity with a possible EU proposal on cross-border access to e-evidence. Measure 4: bilateral international agreements This measure would seek to address problem drivers 1 to 3 by reducing the need for judicial cooperation, regulating direct cooperation and clarifying jurisdiction for investigative measures. It would a