Without most of you even knowing it, Act No. 141/1961 Coll. (Criminal Procedure Code), a new section was added in February this year. Thanks to the brand new Section 7b, any police officer can shut down any website at any time. And so, practically without consequences, it can destroy any thriving e-shop or, for example, shut down a website with “inappropriate” discussion. And what is enough to do that? When the matter cannot be delay ed (and the prosecutor’s consent cannot be secured quickly enough).
How it’s been going so far
Over the last 3 years, we have recorded 1032 requests for information about our customers or the release of various customer data in our internal system for communication with security forces. These are only official requests sent through official channels and are not some third party email requests etc., of which we receive several every day.
We have our own semi-automated system for official requests and two trained and very experienced colleagues with a sense of fairness and knowledge of the whole issue (including from a legal point of view). Both have voluntarily undergone demanding psychological stress tests and we have no doubt about their loyalty to the company.
Through this system, we provide the authorities with what the law requires us to do.
At the same time, we very often provide consultations and recommendations to members of the security forces in order to make our cooperation as effective as possible. Quite often we have to advise on how to proceed, how to formulate applications or specify requirements. We will refuse some requests and will not disclose the requested information.
By the way – although we are entitled to adequate financial compensation from the state, we have never asked for any money.
Sometimes it’s stressful. Every day we are not only fighting with various threats and incompetence, but also with ignorance of the law and misunderstanding of the whole technical issue. Sometimes it is from the lawyers (especially here the ignorance of the law is sometimes striking) and sometimes from the police (most often in the lower territorial offices, which is not surprising, because there they have to deal with everything possible) or from various state authorities.
But even the elite can distinguish themselves…
Kocourkov? You don’t think it is? But it’s…
Our legislators were about 23 years behind the development of the Internet. So they took it in baby steps and they want to catch up. Or maybe they want censorship. Or maybe they want a convenient liquidation of some companies. It’s hard to say.
This week, for example, the criminal police from one of the North Moravian districts decided to “take on” our company and our statutory representative. In our opinion, it was completely unjustified, illogical, (probably) illegal and, above all, completely unnecessary.
It started 3 years ago when we denied a request to shut down the site based on an email request from a law firm. We explained to the applicant, i.e. third party (apparently representing the injured party) detailed the entire issue and asked for more details to be provided and sent via data mailbox. Nothing happened.
Subsequently, the Police of the Czech Republic contacted us via data mailbox with a request for information about our client. Which we have complied with to the extent required by law. We have provided the information in an expeditious manner.
Nothing has happened for more than 2 years.
And recently it had a sequel. Even though we have given the Police of the Czech Republic contact information about our client and this client exists – his details are obviously true and he has given his real address, he has even paid and is paying for our services through his own bank account…, we are now almost 3 years later faced with the situation that our company and our statutory representative are under investigation because we refused to shut down the website on the basis of that email appeal. By doing all this, we may have “caused further damage” and “aided and abetted criminal activity”.
For three years, no one has addressed anything… It was only this January 2019 that the summons arrived and the first interrogation took place yesterday. Can you imagine how important information could be given in an interrogation where you are not allowed to use a computer or paper documents?
Our statutory representative certainly knows all the details of each of our 515,000 active services off the top of his head and can automatically answer questions off the top of his head that he is not told in advance and cannot look up on his computer. They naively assume they know everything about all our customers and their services with us. Of course, he knows off the top of his head all the email messages that have been resolved in the history of our company. The current figure for the number of emails handled is 6,716,079 and the number of replies is over 811,290. A waste of time for us, our company, our statutory representative, several police officers (only 2 were at the interrogation plus others to deal with it around)…
And these were elite criminals. Certainly no personnel from the Upper Lower District Department… Surely you can imagine how it all makes sense in other cases.
What about illegitimate requests?
Of course, not everyone likes the content on the free internet. We get more unwarranted “requests” for removal every day than legitimate ones backed by the law. Whether we get letters from various lawyers or sometimes people threatening us with high-level notoriety or media coverage, we make no exceptions. We are only fulfilling our obligations to the state. We don’t give in to pressure!
We do a lot of advocacy for our clients and we have gotten into a lot of unpleasant disputes with various authorities because of it.
Some lawyers in particular can be very persuasive. Fortunately, we are represented by one of the largest and best known law firms, BBH, so when even our boss, originally a trained lawyer, is unsure, we pay for consultations. It’s not cheap. In total, we pay over a million a year for legal services, but if you want to do hosting properly these days, you can’t do without it. Putting your head down and sacrificing a customer’s website just because someone threatens you is simply not an option.
You can read how a big TV station, a bank subsidiary or even the Police of the Czech Republic tried it on us in the article Hosting. Pressure. To succumb or not to succumb? That was 2013 and we were a lot smaller. At that time we had the company for less than 3 years and we were just starting out.
Today we are almost 6 years older and in the meantime we have become the largest .CZ domain registrar, the largest hosting provider in the Czech Republic and probably the largest cloud provider in the Czech Republic. We have something to do with about 18% of all Czech domains and Czech internet content. So you can imagine how many requests and how much pressure is coming at us from all sides.
Over the years we have encountered hundreds of other demands in the form of strong pressure. For example, we refused to shut down service based on a completely confusing decision by a major government agency. We argued with the highest officials of this central government body (almost to the point of tearing our bodies apart :)), and even the real threat of a 5 million CZK fine for disobedience did not break us. Only after several days of difficult negotiations did we manage to break them and convince them that this is not the way to go. But we had to involve various IT experts.
On another occasion, we refused to release complete data (including the database and email history) of a large furniture e-shop to the court, because it was a dispute that was not directly related to this content at all. We also fought with the judge for many hours and finally we explained it to her and all we had to do to settle the dispute was to provide one and only one piece of information (the exact date and time of creation of one file). Maybe that’s how we saved the e-shop. After all, today the court, the police, several forensic experts and even the opposing party would have complete information about the entire e-shop (and therefore the entire company). So the counterparty would know the customers, the suppliers, the purchase prices, all the agreed terms and conditions…
We could give more such examples.
We always try to respect the law but also use common sense. Most of the time we take everything in perspective. So let’s imagine a similar situation and that it was our data. Now imagine this for the last two examples given. We would certainly not mind if our website was shut down by an official just because some advertising link leading somewhere abroad appeared on our website. Or (as in the last mentioned case of the furniture e-shop) it would certainly bother us if (de facto) our competitor wanted all the data about our company (including source codes, databases, orders, information about all customers, complete e-mail communication…), just on the grounds that we have the same icon on our website as he does and it is necessary to judge who had it first and who is therefore probably the author…
Can you imagine the anarchy? We understand that officials, police officers or even judges cannot understand this. But they also can’t blindly decide on something they don’t understand…
It often costs us quite a lot of effort and the costs are also not negligible. It usually takes many hours of work and explanation. Other times we have to pay a law firm. Sometimes it’s just nerves and sometimes it’s thousands or hundreds of thousands of crowns. The most expensive dispute so far has cost us hundreds of thousands of crowns.
We have always justified all our arguments to the relevant authority, and in the end we have succeeded. But it cost us a lot of effort, a lot of time and a lot of money. We protect our clients and our reputation.
Try to think who among your competitors would do it for you if one potential lawsuit could be financially devastating for them.
We are unequivocally in favour of compliance with the law. We are unequivocally in favour of freedom of speech, and we know its limits. Plain and simple, we protect our clients and our reputation.
Is seven a lucky number? Certainly not for the Czech internet…
But let’s return to the original topic of the new section 7b in Act No. 141/1961 Coll. Criminal Procedure Code. It is unbelievable that such a thing has appeared in our legal system. It is such an easily abused institution that gives the members of the Police of the Czech Republic enormous powers. They don’t have that kind of power anywhere in an offline environment.
It is comparable to the Police of the Czech Republic suddenly being able to conduct searches only at the discretion of the officer and only because of a rumour from a neighbour…. Alternatively, as if it could close factories and businesses for up to 90 days, again at the discretion of one officer.
First of all, the full text of the new paragraph (paragraph 2 is particularly interesting):
(1) Where it is necessary to prevent the loss, destruction or alteration of data relevant to criminal proceedings which are stored in a computer system or on a medium, the person who holds or has under his control the data may be ordered to, to retain such data unaltered for the period specified in the order and to take the necessary steps to prevent disclosure of the fact that retention has been ordered.
(2) Where necessary to prevent the continuation or repetition of criminal activity, a person who holds or has under his control data stored in a computer system or on a medium may be ordered to prevent other persons from accessing such data.
(3) An order under subsection (1) or (2) may be issued by the President of the Chamber and, in pre-trial proceedings, by the public prosecutor or a police authority. The police authority needs the prior consent of the public prosecutor to issue such an order; without prior consent, an order may be issued by the police authority only if prior consent cannot be obtained and the matter cannot be delayed.
(4) An order under subsection (1) or (2) shall specify the data to which the order relates, the reason for which the data are to be retained or access to them is to be prevented and the period for which the data are to be retained or prevented, which shall not exceed 90 days. The order shall contain a statement of the consequences of disobeying the order.
(5) The authority which has issued an order under subsection (1) or (2) shall promptly deliver it to the person against whom it is directed.
Under this new section, any police agency in our country can now request a shutdown of any service for up to 90 days with (virtually) absolutely no consequences to them.
Preventing the continuation or repetition of the criminal activity is sufficient as a reason. Which can be, for example:
- Slander (I guess it’s time to stop writing about someone what they may not like) – Here we are currently dealing with a case from a large Czech city. The case is a political one, with two feuding political parties “arguing” over an internet discussion. We refuse to adjudicate their dispute and shut down a particular website just because some deputy mayor doesn’t like it. But we have already received several “urgent” requests on the matter, and from different attorneys and lawyers.
- Fraud (what if your e-shop seems fraudulent to your competitors because you have very low prices). – We have encountered that, for example, the owner of a small e-shop was hospitalized and immediately the whole e-shop was labeled as fraudulent.
- Illegal dissemination of content (maybe a link is not a crime, but a reason to shut down a site is?).
- A general threat (perhaps an article that could act as such).
- Attack against humanity (preparation at the stage of writing the commentary).
- Discrimination (everyone sees it everywhere these days)…
You may be thinking that in order for the relevant police authority to order this, there is clearly a requirement that it must only be if prior consent cannot be obtained and the matter cannot be delayed. The truth is that defending on the internet that the matter cannot be postponed is not difficult. After all, a million people can see the content on the internet every second, what if a widely read online newspaper took it over 😉
Likewise, the content can be completely different every minute and can change at any time. There is always a reason for action. No one is responsible for anything. A clerk or a policeman, not so much. And given the correct official procedure, you are not even entitled to any compensation for damages. Frankly, we can’t even imagine any compensation for the damage and in what amount…
We are not saying that abuse will always occur, but it can. It could have been written a thousand other ways and specified more precisely. This one is probably the least appropriate. Given our experience in the hosting industry since 1996 (yes about 23 years), we know how some authorities deal with individual problems. The error is not always intentional. Sometimes it just stems from ignorance of technical issues. For example, by ordering the shutdown of one site, it will be necessary to shut down the entire server, where there will be hundreds or thousands of other (unrelated) domains (and thus services and sites). Just explain to someone that you can’t just turn it off…
You can’t solve everything by moving abroad. You cannot host a serious website or e-shop (also because of GDPR) just anywhere. And here we are not talking about shutting down problematic and illegal sites, but about the potential for abuse for shutting them down over trivia. Maybe because of a dispute over an icon or an inappropriate comment in a discussion.
Remember that whatever can be abused, will be abused sooner or later…
Maybe one day it will be your website or e-shop…
It’s strange that this got quietly put into law and there was no mention of it anywhere. It’s strange that this hasn’t sparked any discussion. The internet public has rebelled against other things over time…
So far, this new legal provision is practically unknown to the public. It is also mostly unknown to the authorities. We’ll see how it’s handled and how it’s abused. Maybe not 🙂