We are still focusing on the criticism of the new provision of the Criminal Procedure Code, which has been in force since February 2019. Since February, police officers have been able to shut down websites and servers for up to 90 days without a court or prosecutor’s decision.
As this is a legal issue, it is very difficult for the general public to understand. That’s why we have prepared this article, where everything is simply summarized. You will also learn who can tell us to shut down your website and how.
What we see as the problem
Since February 2019, we have had section 7b inserted into the Criminal Procedure Code, which contains a very problematic paragraph (2). The new paragraph gives police authorities incredible powers. From February 2019, police authorities can shut down any website or server for up to 90 days. They can do everything on their own, without the court or the prosecutor’s approval. Until now, this has not been possible, and judicial approval was required to shut down the site.
It is enough that it is an urgent matter, which the police can easily justify, because everything changes very quickly and dynamically on the Internet.
Shutting down the website or server, or otherwise making the data unavailable, must be done immediately and for up to 90 days. The hosting company may file a complaint, but it will have no suspensive effect and it is the hosting company’s responsibility to immediately disable the service.
Such legislation is unprecedented in the civilised world. Nowhere do police officers have such general authority to shut down websites, servers (or make any data inaccessible). In foreign jurisdictions, they can take similar steps only with the consent of the court, and exceptionally with the consent of the prosecutor.
Current possibilities of the Police of the Czech Republic
We disagree that the new legislation is okay, and that it is a refinement of existing practices. Read the following paragraphs carefully.
Until now, the Police of the Czech Republic could only proceed against hosting companies in the following way according to the Criminal Procedure Code (the interpretation presented is for the sake of illustration of the original situation and complex details are omitted):
The procedure under Section 8 of the Criminal Procedure Code, which only allows obtaining information about the customer, the order made, the contractual relationship, and, for example, payments made for services. That is all the police officers can ask for, or are obliged to grant. Under this provision, the police could never and cannot shut down websites or servers.
The procedure under Section 78 of the Criminal Procedure Code (obligation to produce or hand over an item) addresses situations where everyone is obliged to hand over an item that is important for criminal proceedings. The primary concern is extradition to the court or prosecutor. Exceptionally to the police. In simple terms, however, the hosting can refuse to release the case and any complaint has suspensive effect.
The procedure under Section 79 of the Criminal Procedure Code (confiscation of the item) deals with situations where the item is not voluntarily surrendered (for example, under the previous section). Only the court or the public prosecutor can make a decision to withdraw the case. Without the prior consent of the said court or public prosecutor, the matter may be taken away by the police authority only if the prior consent (of the court or public prosecutor) cannot be obtained and the matter cannot be delayed. If possible, a person who is not involved in the case shall be added to the withdrawal. In this case, it should be a form of seizing servers in datacentres.
The aforementioned §78 and §79 can be used to secure evidence in a criminal proceeding and therefore not to shut down a service. However, the seizure of evidence can be dealt with in a different way than seizing servers, which is why it has not been used and perhaps never has been used in the Czech Republic.
There are other sections in the Criminal Procedure Code that have touched or are touching on hosting, for example, §79a to 79g (seizure of instruments of crime and proceeds of crime). For example, the CZ.NIC association used the institute“§79e Seizure of intangible property” to shut down some domains, which is no longer found in the Criminal Procedure Code due to a change in the concept of “property”, which now includes intangible property. For our illustrative analysis, this is not essential, because in any case, the decisionto seize the instruments of crime is made by the court or the prosecutor. If it is an urgent situation, the seizure can be carried out directly by the police authorities, but they must subsequently obtain the consent of the public prosecutor within 48 hours. The purpose is to limit the rights to a certain thing or other property value in order to limit the continuation of criminal activity or to subsequently obtain compensation for the victim.
The following provisions may be used only when facts relevant to the criminal proceedings cannot be obtained in any other way. These are already quite substantial encroachments on the rights of individuals.
The procedure under Section 88 of the Criminal Procedure Code (interception and recording of telecommunications traffic) is essentially securing the content of the transmitted information, including traffic and location data. This means any electronic, but especially e-mail communication. However, it can only be used for more serious crimes (with a maximum penalty of at least 8 years and a few enumerated crimes with a lower penalty). This activity can be carried out by the police only with the court’s approval. The interception is from the issuance of the decision until the future (maximum 4 months). Unless there are valid reasons, it is necessary to terminate early.
The procedure pursuant to §88a of the Criminal Procedure Code (interception and recording of telecommunications traffic) essentially concerns data on telecommunications traffic (logs, logs of assigned IP addresses, accesses to mail or to the administration of a service) that are subject to telecommunications secrecy or to the protection of personal and intermediary data. It can only be used for selected offences (more serious offences with a maximum penalty of at least 3 years plus a few listed offences). This activity can be carried out by the police only with the court’s approval. The hosting company is obliged to provide information from the past (if it has it) and in the future, but the decision must have a precise time frame.
The procedure according to §158d paragraph (3) of the Criminal Procedure Code (surveillance of persons and property) is for example the provision of a copy of web and server data, including the contents of an e-mail box. This activity can only be carried out by the police with the approval of the court.
From the above examples, it is quite clear that the previous practice has always required the consent of the court or the prosecutor. In very exceptional cases, it was possible for the police authority to act independently, but then, for example, the police authority had to subsequently obtain the consent of the competent authority.
A reminder of our articles
We have covered the whole issue several times and so we will just refer to our previous articles.
The first article where we pointed this out was published on 19. February. The new provision was inserted into the Czech legal system quite quietly. We were shocked when the Police of the Czech Republic introduced us to it at a personal “special training” and told us that they would follow this provision. They wanted to make sure we understood our new “responsibilities” and would cooperate.
In the second article, a week later, we already responded to the individual issues that were raised on the Czech internet. We also discussed the fact that we cannot make excuses for the EU. The EU did not ask for similar rules and apparently they do not apply anywhere in the EU. Everybody can criticize, so we proposed a solution. At the same time, we pointed out one other wickedness in another law.
In our third article from 4. March we made a comparison with the Slovak legislation. Why Slovakia? Firstly, the legal systems of the two countries are the closest, and at the same time the government’s draft of the problematic provision argued that Slovakia has similar legislation. We refuted it. In Slovakia, the shutdown of the website must be approved by the court or the prosecutor (public prosecutor). Similar procedures exist in Poland. In Russia, the situation is different, but they have procedures for shutting down and they are handled by specialized authorities who have experience in this.
We have previously drawn attention to police practices that we believe were illegal. We have seen many attempts to shut down websites and servers. Previously, we could “stand up” and defend ourselves and our customers. This is no longer possible from February.
From the examples given, it is quite obvious that police officers cannot have such unlimited powers because their creativity is almost limitless. We have many examples from practice, because we deal with several requests from the Police of the Czech Republic every day.
Technical issues
The whole matter is very problematic not only from a legal point of view, but also from a technical point of view. For example, the police have not used §79 because it is very difficult to identify which physical server contains a particular piece of data and which item must be “seized” to make it inaccessible. Nowadays, data is distributed across different technical solutions, and shutting down one server (or a group of servers) will not ensure that the dissemination of information is actually reduced. For example, if you shut down one of our servers, the service will start automatically on another (for example, in another datacenter).
The unintended consequences of shutting down one service can be catastrophic for thousands or even hundreds of thousands of other services. For example, there are more than 300,000 other domains linked to our wedos.cz domain that could be broken. Similarly, police authorities may want to turn off a service, but it is part of another “package” of services and it is not possible to selectively turn it off. Again, no one knows what consequences this may cause.
Similarly, we saw the shutdown of a .com domain that was the CDN for tens of thousands of other sites, and they stopped working. The reason for shutting down that domain was that one of the sites that used the CDN used an image that infringed copyright.
We are under no illusion that police officers from district departments can have the IT experience and knowledge to ensure that no mistakes or ill-considered connections are made. Unfortunately, any context is hard to predict in advance.
Shutting down is easy, but the consequences can be disastrous. Impact on other services, other customers. For example, the impact on a company that shuts down an e-store. After 90 days, the cops don’t even have to turn it on. The company will no longer exist. For any website, even a discussion forum, it’s similar. Search engines stop indexing the entire site and the server administrator can start again after 90 days…
Or perhaps an example from practice – by shutting down a website, server or domain, it may happen that tomorrow there will be no fresh pastries in your shop. Bakeries also have online orders. Or the public transport in your city stops working because the whole system is tied to some domain, some server. And we could go on like this. Yet it takes little to shut it down. One any active police officer who sends us a shut down notice under the newly amended law. There is no defense.
We cannot omit the information that everyone will try to circumvent the new provisions. They will simply host servers and websites abroad. Police authorities won’t be able to shut anything down. In terms of data release, the server operators will defend themselves with encryption and the police will only get a “pile” of encrypted data.
Why haven’t others come forward? We don’t know.
During one of our interviews with a major newspaper yesterday, we were asked, “Why haven’t we heard from other hosts?” We don’t know. Maybe because they didn’t know about it. We admit that we did not know about this either until we were introduced to the new section by the Police Presidium staff. Maybe they don’t speak up because they don’t understand the issues. Perhaps they are not responding because WEDOS, the largest and fastest growing and quite commercially aggressive competitor in the market, has been the first to respond. We don’t know. That’s more of a question for others. You can ask your hosting company yourself.
Nobody hosts so many services in the Czech Republic. Few people in the Czech Republic have been in the hosting business professionally since 1997. So few people will have as much experience, even bad and very unpleasant experience, with the whole issue as we have.
It is striking, however, that others have spoken out in the case of various activities that were supposed to be about saving the Internet and Internet freedoms. And yet these were quite minor restrictions. But that’s where it started… First, there were restrictions on ads on foreign gambling sites. As a result, copyright is restricted and copyright law and the rights of copyright holders are very often violated. That’s what they all fought for. And now, when it comes to real restrictions and a big risk to our future, no one has spoken up.
We must fight for freedom
We must fight for freedom. It is not possible for us to silently agree and let our freedoms be stolen step by step. In the end, we might not have any freedom at all.
The police force is part of the executive branch and certainly the police should not have similar powers as the courts. Then maybe we wouldn’t even need the courts…
Why can Slovakia or Poland, for example, have more appropriate legislation than we do?
Finally, we would like to thank all the brave people who have supported us in our activity by sharing our articles or social media. We cannot let freedom be stolen.