Provision of Real-time Lawful Interception Assistance

CONSTITUTION OF THE REPUBLIC OF SERBIA (Official Gazette of the Republic of Serbia no. 98/2006, Ustav Republike Srbije) (the “Constitution”)

Article 41 of the Constitution guarantees the confidentiality of letters and other means of communication, and provides that derogation from this right is allowed only if necessary to conduct criminal proceedings or to protect the security of the Republic of Serbia, in a manner stipulated by the law and by a decision of a competent court. Any such derogation must be for a specified period of time.

ELECTRONIC COMMUNICATIONS ACT (Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

Article 37, paragraph 2, subparagraph 17 and Article 127, paragraph 1 ECA oblige network operators and service providers to enable the lawful interception of electronic communications required by government agencies for the purpose of criminal investigations. Interceptions of electronic communications which reveal the content of a communication are allowed only for a limited period of time and on the basis of a court decision, if such interception is necessary to conduct criminal proceedings or for the protection of national security as per Article 126, paragraph 1.

The ECA does not specify which government agencies may request interception or the maximum duration of any interception carried out. However, since interception is allowed for the purposes of conducting criminal proceedings or for the protection of national security, only government agencies which operate in these areas (the police, the State Prosecutor, the Security-Intelligence Agency and the Military Security Agency (Proveriti na kraju) would be authorised to require interception in accordance with the ECA and the legislation specific to their activities (described further below), which also regulate the maximum duration of each interception.

Articles 37 and Article 127 provide that network operators and service providers have an obligation to enable the lawful interception of electronic communications. Article 127 obliges network operators and service providers to provide, at their own expense, the necessary technical and organizational conditions (equipment and software support) to enable the interception of electronic communications and to inform the Agency for Electronic Communications (the “Agency”) about the interception. Article 126 paragraph 1 states that the interception of electronic communications through which the content of communication is disclosed is not allowed without consent of the user, except for a definite period of time based on a decision of the competent court and only where it is necessary for the conducting of criminal procedure or the protection of security of the Republic of Serbia, in a manner prescribed by law. The court decision should specify the government agency designated to conduct the interception.

Government agencies that conduct lawful interceptions are obliged to keep records of the interceptions and to keep these records as a secret pursuant to Article 127 paragraph 2. According to Article 127 paragraph 3 ECA, if a government agency which is authorised to intercept an electronic communication and is not able to do so without requiring assistance to access the premises, the electronic communications network, other instruments or the electronic communications equipment of the network operator or service provider, the obligation to keep records of the interception lies with the network operator or service provider. In both instances, under Article 126 paragraph 1, a court decision is required to authorise the interception.

CRIMINAL PROCEDURE CODE (Official Gazette of the Republic of Serbia nos. 72/2011, 101/2011, 121/2012, 32/2013, 45/2013 and 55/2014, Zakonik o krivičnom postupku) (the “CPC”)

Article 161 CPC provides that interception and surveillance of electronic communications may be employed, as special investigation measures, in pre-formal and formal investigation stages of criminal proceedings, and ordered against a person suspected of committing or preparing a war crime, organized crime, cybercrime or one of various listed serious crimes (stated in Article 162, paragraphs 1, 2 and 3), if evidence of that crime cannot be collected in any other way, or if gathering evidence by regular investigatory measures would cause significant difficulties.

The order for interception is issued by the competent criminal court upon the request of the State Prosecutor for a period of three months with the possibility of an extension of three more months. In cases of war crimes and organized crime, this maximum six months period may be extended twice, each time for an additional three months as per Articles 166 and 167.

Article 168 provides that the interception may be performed by the police, the Security-Information Agency or the Military Security Agency. If during the interception the relevant government agency obtains information indicating that a person is using or has used another phone number or address, the interception may be extended to include that phone number or address also, by a decision of the director of that government agency, who will also notify the State Prosecutor. The State Prosecutor will subsequently file the request for an extension with the competent criminal court which will, under Article 169 either, render a new decision approving the extension or order the destruction of the materials collected.

POLICE ACT (Official Gazette of the Republic of Serbia no. 6/2016, Zakon o policiji) (the “PA”)

The PA authorises the police to intercept electronic communications if such interception is necessary to arrest or apprehend a person reasonably suspected of having committed an offence punishable with imprisonment of four or more years and for whom an international arrest warrant is issued, if the police cannot apprehend such a person by other means or when other means would involve disproportionate difficulties.

The request for interception is submitted by the director of the police and approved by the president of the Cassation Court or, in the absence of the president of the Cassation Court, by a judge of the Cassation Court authorised to rule on such a request. Each interception may last up to six months and may be extended by an additional six months.

Materials collected by an interception may not be used as evidence in criminal proceedings and must be submitted for destruction to the president of the Cassation Court or the authorised judge of that court immediately upon completion of the interception. In circumstances in which waiting for the court’s approval might jeopardise a police investigation, the interception may be ordered by a decision of the director of the police, with prior written approval of the president of the Cassation Court or the authorised judge of that court. In such cases, the director of the police is obliged to submit to the court a written request for continued interception within 24 hours from obtaining prior approval. The court, under Article 60, will decide on the continuation or suspension of the interception within 72 hours of receipt of the request.

SECURITY-INFORMATION AGENCY ACT (Official Gazette of the Republic of Serbia nos. 42/2002, 111/2009, 65/2014 and 66/2014, Zakon o bezbednosno-informativnoj agenciji) (the “SIAA”)

The SIAA provides for secret surveillance and recording of communications or surveillance of an electronic or any other address as special measures which may be employed against a person, group or organization that is reasonably suspected of undertaking or preparing activities which threaten the security of the Republic of Serbia. Such special measures may only be used pursuant to Articles 13 and 14 when the circumstances of the case indicate that the suspected activities could not be discovered, prevented or proved by other means, or that other means would involve disproportionate difficulties or serious danger. The SIAA does not define serious danger nor specify who should be in serious danger for these provisions to take effect.

Article 15 provides that secret surveillance must be requested by the director of the Security-Information Agency and ordered by the president of the Higher Court in Belgrade (the “President”) or a judge of the special department of the Higher Court in Belgrade who handles cases of organized crime, corruption and other serious offences (the “Judge”). The interception may be ordered for a period of three months and, if necessary, may be extended up to three times, each time for a period of three months as per Article 15a.

If during the interception the Security-Information Agency obtains information indicating that the subject of the interception is using other means of communication, the director of the Agency may file a request for extension of the interception to include the discovered means of communications. If the President or Judge adopts this request, a new decision will be rendered approving the extension. If the request is rejected the collected materials must be destroyed as stipulated in Article 15b.

MILITARY SECURITY AGENCY AND MILITARY INTELLIGENCE AGENCY ACT (Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA”)

Under the MSA, the Military Security Agency, which is in charge of security and counter intelligence protection of the Ministry of Defence and Military of the Republic of Serbia as per Article 5, is authorised under Articles 11 and 12, to secretly collect data as a special measure (including interception under the ECA) if this data cannot be collected by other means or if collection of this data by other means would cause disproportionate risk to the lives and health of people and property, or disproportionate expense. Article 11 paragraph 2 further states that information may be collected for the purpose of preventing threats directed at the Ministry of Defence and the Military of the Republic of Serbia.

This measure can be applied on the basis of a written and reasoned decision of the Cassation Court in response to a request of the Director of the Military Security Agency and may be ordered for a period of six months, with the possibility of extension by an additional six months as per Articles 14 and 17.

Disclosure of Communications Data

CONSTITUTION OF THE REPUBLIC OF SERBIA (Official Gazette of the Republic of Serbia no. 98/2006, Ustav Republike Srbije) (the “Constitution”)

With reference to Article 41 of the Constitution (described above), the Constitutional Court of Serbia has issued held that derogation from the confidentiality of “other means of communications” includes not only interception of communications which would reveal the content of communications, but also the collection of metadata. Consequently, the Constitution Court has confirmed its prior opinion that the limitation of the right to confidentiality of communication transferred by telecommunication networks may be done only on the basis of court decision (DecisionIUz-1218/2010 of the Constitutional Court of Serbia).

ELECTRONIC COMMUNICATIONS ACT (Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

According to Article 128 paragraph 2, network operators and service providers are obliged to disclose retained metadata to government agencies (the police, the State Prosecutor, the Security-Information Agency and the Military Security Agency) that obtain a court decision allowing them such access for a limited period of time and for the purpose of conducting criminal proceedings or national security.

According to Article 128 paragraph 6 and Article 129, network operators and service providers are obliged to retain (for a period of 12 months) data:

(a) tracing and identifying the source of a communication;

(b) identifying the destination of a communication;

(c) determining the beginning, duration and end of a communication;

(d) identifying the type of communication;

(e) identifying users’ terminal equipment; and

(f) identifying the location of the users’ mobile terminal equipment.

Network operators and service providers must retain customers’ metadata for a period of 12 months and government agencies are only allowed to request access to such metadata.

Under Article 129, network operators and service providers must not retain the content of customer communications. Since however Article 126 and 127 allow the interception of electronic communications on the basis of a court decision, if such a court decision contains an order for the retention of the content of electronic communications, then network operators and service providers would be obliged to act upon it.

CRIMINAL PROCEDURE CODE (Official Gazette of the Republic of Serbia nos. 72/2011, 101/2011, 121/2012, 32/2013, 45/2013 and 55/2014, Zakonik o krivičnom postupku) (the “CPC”)

Under the CPC, computer data searches of processed personal data and other data may be employed as a special investigation measure covering the collection of metadata retained by a network operator or service provider for the pre-trial and investigation phase of criminal proceedings. These measures may be ordered in relation to a person suspected of committing or preparing a war crime, organized crime, cybercrime or one of the listed serious crimes, if evidence of that crime cannot be collected in any other way or if gathering evidence by regular investigation measures would cause significant difficulties as per Articles 161, 162 and 178.

Pursuant to Article 167, the order for a computer data search will be provided by the competent court, upon the request of the State Prosecutor, for a period of three months with the possibility of up to two extensions, each time for an additional three months

Under Article 180, this measure is implemented by the police, the Security-Information Agency, the Military Security Agency, the customs, tax and other state authorities, or legal entities vested with official authority.

POLICE ACT (Official Gazette of the Republic of Serbia no. 6/2016, Zakon o policiji) (the “PA”)

Under the PA, the police are authorised to obtain metadata relating to electronic communications if it is necessary for arresting or apprehending a person who is reasonably suspected of having committed an offence punishable with imprisonment of four or more years, and for whom an international arrest warrant is issued, if the police cannot apprehend such a person by other means or when other means would involve disproportionate difficulties.

The request for obtaining metadata relating to electronic communications is submitted by the Director of the police and approved by the President of the Cassation Court or, in the absence of the President of the Cassation Court, by an authorised judge of the Cassation Court, within 72 hours of the receipt of the request. As per Article 60, this measure may last up to six months and may be extended by an additional six months.

SECURITY-INFORMATION AGENCY ACT (Official Gazette of the Republic of Serbia nos. 42/2002, 111/2009, 65/2014 and 66/2014, Zakon o bezbednosno-informativnoj agenciji) (the “SIAA”)

Under Article 13 and 14 SIAA, obtaining metadata may be ordered as a special measure when the metadata relates to the communications of a person, group or organization under reasonable suspicion of undertaking or preparing activities which threaten the security of the Republic of Serbia, and the circumstances of the case indicate that their activities may not be discovered, prevented or proved by other means or that other means would involve disproportionate difficulties or serious danger.

Article 15 stipulates that this measure must be ordered by the President of the Higher Court in Belgrade (the “President”), or a judge of the special department of the Higher Court in Belgrade who handles cases of organized crime, corruption and other serious offences (the “Judge”), upon the request of the Director of the Security-Information Agency. The measure may be ordered for a period of three months and if necessary may be extended up to three times, each time for a period of three months as per Article 15a.

If disclosed metadata indicates that an individual, group or organization is using other means of communication, the director of the Security-Information Agency may order an extension of the special measure and subsequently file a request for the extension of a measure in relation to the discovered means of communications. If the President or Judge adopts this request, he/she will render a new decision approving the extension. Where such a request is not adopted, the collected materials must be destroyed in line with Article 15b.

MILITARY SECURITY AGENCY AND MILITARY INTELLIGENCE AGENCY ACT (Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA”)

As mentioned above, under Article 11 MSA, the Military Security Agency is authorised to undertake the secret collection of data as a special measure in certain circumstances. Secret electronic surveillance of electronic communications for the purpose of obtaining retained traffic data is a special measure requiring a written decision of the Cassation Court, requested by the Director of the Military Security Agency, and may be ordered for a period of six months, with the possibility of extension for an additional six months pursuant to Articles 14 and 17.

TECHNICAL CONDITIONS

According to the Technical conditions for subsystems, devices, equipment and installations for mobile telecommunication networks no. 1-01-110-7/08 (“Mobile Technical Conditions”), the Technical conditions for subsystems, devices, equipment and installations for landline telecommunication networks no. 1-01-110-8/08 (“Landline Technical Conditions”) and the Technical conditions for subsystems, devices, equipment and installations for internet network no. 1-01-110-19/08 (“Internet Technical Conditions”) issued by the Electronic Communications Agency, network operators and service providers are obliged to remove their encryptions prior to delivery of the content of communications or metadata relating to communications to the competent government agencies (Section 2, Mobile and Landline Technical Conditions and Section 6, Internet Technical Conditions).

National Security and Emergency Powers

DEFENCE ACT (Official Gazette of the Republic of Serbia, nos. 116/2007, 88/2009, 88/2009 and 104/2009, Zakon o odbrani) (“DA”)

According to Article 73 paragraph 1 DA, in a state of emergency or a state of war, legal entities in the postal-telegraph-telephone sector and other carriers of telecommunications systems must prioritise the delivery of their services as specified by the Ministry of Defence. The Decision on establishing large technical systems significant for defence (Official Gazette of the Republic of Serbia, nos. 41/2014, 35/2015 and 86/2016) stipulates that Telenor d.o.o., as well as Telekom Srbija a.d, and VIP mobile d.o.o. are significant technical systems in the field of telecommunications which are required to adjust their systems to the needs of the defence system in Serbia.

Article 202 of the Constitution allows for the introduction of measures which would provide derogation from the general protection given to the confidentiality of letters and other means of communication and the protection of personal data (under Article 41 of the Constitution) in a state of emergency or war. Government agencies may, on the basis of such measures, require access to a network operator’s or service provider’s customer communications data and/or network without adhering to the procedure prescribed for obtaining these data in regular circumstances; that is, without presenting a court decision authorizing the interception of the electronic communications or access to the retained data.

Measures providing for derogation from Article 41 of the Constitution are adopted by the National Assembly or, if the National Assembly is not in a position to convene, by government decree with the President of the Republic as a co-signatory in the case of a national emergency (as per Article 200, paragraph 6 of the Constitution) or by the President of the Republic together with the President of the National Assembly and the Prime Minister in the case of a state of war (as per Article 201, paragraph 4 of the Constitution).

Measures providing for derogation from Article 41 of the Constitution in a state of emergency are effective for a maximum of 90 days, with the possibility of extension under the same terms. Measures providing for derogation from Article 41 of the Constitution in a state of war may continue as long as necessary, as decided by the National Assembly, or the government, if the National Assembly is not in a position to convene.

POLICE ACT (Official Gazette of the Republic of Serbia no. 6/2016, Zakon o policiji) (the “PA”)

In accordance with Article 60, in emergency situations, the disclosure of metadata relating to electronic communications may be ordered by a decision of the director of the police, with prior written approval of the President of the Cassation Court or, in the absence of the President of the Cassation Court, by an authorised judge of the Cassation Court, in which case the Director of the police is obliged to submit a written request to the Court allowing the continued collection of metadata within 24 hours of obtaining prior approval.

MILITARY SECURITY AGENCY AND MILITARY INTELLIGENCE AGENCY ACT (Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA”)

In emergencies, and particularly in cases of domestic and international terrorism, secret collection of data may be ordered by a decision of the Director of the Military Security Agency, with the interim prior approval of a judge of the Court of Cassation. The decision will subsequently be assessed in more detail and the judge will either grant a continuation of the measure or terminate the measure within 24 hours of its commencement as per Article 15.

Oversight of the Use of Powers

JUDICIAL OVERSIGHT

Interception of electronic communications conducted by all government agencies authorised to undertake such interception and the retention of the content of electronic communications is overseen by the competent court which ordered the measure and monitors its enforcement (Article 126, paragraph 1 and Article 128, paragraph 2 ECA; Articles 166 and 286 CPC; Article 60, paragraph 2 PA; Articles 15 and 16 SIAA; Articles 14 and 15 MSA). If the materials obtained by interception were not collected in accordance with the prescribed procedure, the competent court will order their destruction (Article 163 CPC; Article 15b SIAA; Article 15 MSA).

ELECTRONIC COMMUNICATIONS ACT (Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

The ECA contains provisions concerning the general oversight of network operators’ and service providers’ operations by the Agency for Electronic Communications (the “Agency”) and the Inspectorate of the Ministry of Trade, Tourism and Telecommunications (the “Inspectorate”).

At the request of the Agency, network operators and service providers are obliged to submit information on the protection of customers’ personal data and privacy as per Article 41; to correct irregularities in its technical and organizational settings (enabling interception) identified by the Agency; and to inform the Inspectorate if a network operator or service provider does not comply with its request in accordance with Article 131.

Under Articles 132 and 134 paragraph 1, subparagraph 6, the supervision of network operators and service providers is also conducted by the Inspectorate. The Inspectorate is authorised to order a network operator or service provider to remedy irregularities, oversights or omissions in its work within a given period of time as per Article 135 paragraph 1, subparagraph 1.

Under Articles 132 and Article 134 paragraph 1, subparagraph 6, the Ministry of Trade, Tourism and Telecommunications also monitors network operators’ and service providers’ assistance in implementing interception capabilities. The Ministry of Trade, Tourism and Telecommunications is authorised to order network operators and service providers to implement such capabilities within a given period of time and to temporarily suspend their activities if they do not comply as per Article 135, paragraph 1, subparagraphs 1 and 3.

Network operators, service providers and government agencies are obliged to submit records in relation to requests received to access retained data in the preceding year on 31 January of each year to the Commissioner for Personal Data Protection.

The Commissioner is authorised under Articles 44, 45 and 56 PDPA to order certain measures if the data processing conducted was not in accordance with the law.

POLICE ACT (Official Gazette of the Republic of Serbia no. 6/2016, Zakon o policiji) (the “PA”)

According to Article 225, police activities are generally supervised by a special department of the Ministry of Police – the Division of Internal Control, which monitors the legality of police work, especially with regards to the respect and protection of human rights in the performance of police tasks and applying police powers.

MILITARY SECURITY AGENCY AND MILITARY INTELLIGENCE AGENCY ACT (Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA”)

Article 57 provides for internal control of the Military Security Agency, conducted by the Division of Internal Control of the Military Security Agency. There is also political supervision over the work of the police, the Security–Information Agency and the Military Security Agency by the National Assembly and the government as per Article 17 SIAA and Article 57 MSA.

CONSTITUTION OF THE REPUBLIC OF SERBIA (Official Gazette of the Republic of Serbia no. 98/2006, Ustav Republike Srbije) (the “Constitution”)

According to Articles 168 and 170, the Constitutional Court of Serbia, which is authorised to assess constitutionality and legality of laws and other general acts, may find that a measure of derogation from confidentiality of letters and other means of communication and the protection of personal data introduced during a state of war or emergency is unconstitutional.

LAW ON CONSTITUTIONAL COURT OF SERBIA (“Official Gazette of the Republic of Serbia, nos. 09/2007, 99/2011, 18/2013 and 40/2015, Zakon o ustavnom sudu)

Network operators and service providers may file a constitutional appeal against a decision of a government agency as an individual act which violates Constitutional guarantees, when other legal remedies have been exhausted or are not prescribed or where the right to their judicial protection has been excluded by law as per Articles 82 and 83.

Censorship-related Powers

ENFORCEMENT AND SECURITY ACT(Official Gazette of the Republic of Serbia, nos. 106/2015 and 106/2016, Zakon o izvršenju i obezbeđenju) (“ESA”)

There is no provision which explicitly regulates censorship and authorises government agencies to request censorship of customer communications. However, network operators and service providers would be obliged to censor customers’ communication pursuant to the ESA, if such order were given by a competent court in the form of an interim measure or in the form of a final court decision.

ELECTRONIC COMMERCE ACT (Official Gazette of the Republic of Serbia, nos. 41/2009 and 95/2013, Zakon o elektronskoj trgovini)

Based on the request of the person whose rights are threatened, the court may decide under Article 21a paragraph 1 to limit the provision of the informatics society service, if that person can prove that the breach exists and if the person can prove that irreparable damage may occur. All service providers who transfer, store or provide access to data to which this measure is referred to, are obliged to act in accordance with such a court decision under Article 21a paragraph 2.

ELECTRONIC COMMUNICATIONS ACT (Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

Article 127 paragraph 3, prohibits network operators and service providers from publishing records on requests received for an interception which contain data identifying an authorised person who conducted the interception, the decision which provided the legal basis for interception and the date and time of the interception.

Publication of Laws and Aggregate Data

There is no law prohibiting the publication of any of the laws mentioned in this report or any description of the powers set out in any of those laws.

ELECTRONIC COMMUNICATIONS ACT (Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

Article 127 paragraph 3 ECA prevents network operators and service providers from publishing records of requests for interception or access to metadata that provide information on: the identity of the persons conducting the interception or who gained access to the metadata, the identity of the people whose communications were intercepted or whose metadata was accessed, the purpose of the interception or access, or the time and place of the interception or access.

This would not, however, prevent network operators or service providers publishing aggregate data on the number of requests to intercept communications for example, provided that none of the above information is included in this publication.