Rejection of direct cross-border collection of internet traffic data from foreign provider due to lack of prerequisites under Art. 32 CCC

Facts

The Public Prosecutor’s Office II of the Canton of Zurich is conducting a criminal investigation into offences under Art. 259 SCC (dissemination of racist content) and Art. 261bis SCC (dissemination of xenophobic content). The unknown perpetrators are accused of having published racist posts on a social network website in the summer of 2014.

On 27 August 2014, the Public Prosecutor’s Office issued a retroactive order for a period of six months for the disclosure of the so-called "IP history" (traffic data of the relevant website and the participating user profiles) as well as the registration data of the respective customers from an internet service provider domiciled in the USA. The order was based on Art. 273 CrimPC and Art. 32 lit. b of the International Cybercrime Convention (CCC).

The Coercive Measures Court of the Canton of Zurich dismissed the application by order of 8 September 2014, insofar as it was considered admissible. The Higher Public Prosecutor’s Office of the Canton of Zurich filed an appeal against this decision on 10 October 2014 with the Federal Supreme Court. It requested the annulment of the contested decision and the approval of the surveillance request.

The Federal Supreme Court dismissed the appeal on 14 January 2015 (BGE 141 IV 108).

Considerations

1. Examination of direct cross-border collection of traffic data under Art. 32 CCC

The Federal Supreme Court first examined whether the prerequisites for a direct cross-border access to the traffic data ("IP history") stored by a US provider under Art. 32 lit. b CCC were met. This provision allows direct access without formal mutual legal assistance if the person concerned has given their voluntary and lawful consent. In the present case, however, the Public Prosecutor’s Office had not obtained such consent. The provider concerned expressly insisted on the formal mutual legal assistance procedure, as evidenced by its letters of 1 July and 11 July 2014. Thus, there was no implied or voluntary consent. Furthermore, Art. 32 lit. a CCC (access to publicly available data) was not applicable since the request related to non-publicly available traffic data.

2. Territoriality principle and necessity of the mutual legal assistance procedure

The Federal Supreme Court emphasised that procedural measures are generally subject to the territoriality principle. Under this principle, state authorities may not perform sovereign acts on foreign territory. This applies in particular to the collection of evidence or the monitoring of telecommunications abroad. The ordinary procedure of international mutual legal assistance in criminal matters must therefore be followed. In relations between Switzerland and the USA, the International Cybercrime Convention (CCC) and the Mutual Legal Assistance Treaty between Switzerland and the USA (MLAT) apply. The Public Prosecutor’s Office should therefore have filed a formal mutual legal assistance request under Art. 31 CCC or Art. 1 para. 1 lit. a MLAT.

3. Distinction between traffic data and subscriber data

The Federal Supreme Court distinguished between traffic data (Art. 1 lit. d CCC, Art. 273 CrimPC) and subscriber data (Art. 18 para. 3 CCC, Art. 14 SPTA). Traffic data includes information about the communication (e.g. IP addresses, timestamps), while subscriber data relates to information about the subscriber themselves (e.g. name, address). The collection of traffic data requires judicial approval under Art. 273 para. 2 CrimPC, whereas subscriber data requests may be made without…