Provision of Real-Time Lawful Interception Assistance

Constitution of the Republic of Serbia

(Official Gazette of the Republic of Serbia no. 98/2006, Ustav Republike Srbije) (the “Constitution”)

The Constitution guarantees the confidentiality of letters and other means of communication, and provides that derogation from this right is allowed only if necessary to conduct criminal proceedings or to protect the security of the Republic of Serbia, in a manner stipulated by the law and by a decision of a competent court.  Any such derogation must be for a specified period of time (Article 41).

Electronic Communications Act

(Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

The ECA obliges network operators and service providers to enable lawful interception of electronic communications required by government agencies for the purpose of criminal investigations (Article 37, paragraph 2, subparagraph 17 and Article 127, paragraph 1). Interceptions of electronic communications which reveal the content of a communication are allowed only for a limited period of time and on the basis of a court decision, if such interception is necessary to conduct criminal proceedings or for the protection of national security (Article 126, paragraph 1).

The ECA does not specify which government agencies may request interception, or the maximum duration of an interception.  However, since interception is allowed for the purpose of conducting criminal proceedings or for the protection of national security, only government agencies which operate in these areas (the police, the State Prosecutor, the Security-Intelligence Agency and the Military Security Agency) would be authorised to require interception in accordance with the ECA and the legislation specific to their activities (described further below), which also regulate the maximum duration of each interception.

Article 37 and Article 127 provide that network operators and service providers have an obligation to enable lawful interception of electronic communications. Article 127 obliges network operators and service providers to provide, at their own expense, the necessary technical and organizational setting (equipment and software support) to enable interception of electronic communications that reveal the content of communications and to inform the Agency for Electronic Communications (the “Agency“) about the interception. The interception of electronic communications must be authorised by a decision of the competent court, which will specify the government agency designated to conduct the interception.

According to the ECA, if a government agency is authorised to intercept an electronic communication and is able to do so without requiring assistance to access the premises, the electronic communications network, other instruments or the electronic communications equipment of the network operator or service provider, the obligation to keep records of the interception lies with the government agency conducting the interception (Article 127, paragraph 2). Conversely, if the government agency is not able to conduct the interception without assistance, these records must be kept by the network operator or service provider (Article 127, paragraph 3). In both instances, a court decision is required to authorise the interception (Article 126, paragraph 1).

Criminal Procedure Code

(Official Gazette of the Republic of Serbia nos. 72/2011, 101/2011, 121/2012, 32/2013, 45/2013 and 55/2014, Zakonik o krivičnom postupku) (the “CPC”)

The CPC provides that interception and surveillance of electronic communications may be employed, as special investigation measures, in pre-formal and formal investigation stages of criminal proceedings, and ordered against a person suspected of committing or preparing a war crime, organized crime, cyber-crime or one of various listed serious crimes (stated in Article 161, paragraphs 2, 3 and 5), if evidence of that crime cannot be collected in any other way, or if gathering evidence by regular investigation measures would cause significant difficulties (Article 161).

The order for interception is issued by the competent criminal court, upon the request of the State Prosecutor for a period of three months with the possibility of an extension of three more months.  In cases of war crimes, organized crime and cyber-crime, this maximum six months period may be extended twice, each time for an additional three months (Article 167).

The interception may be performed by the police, the Security-Information Agency or the Military Security Agency (Article 168). If, during the interception, the relevant government agency obtains information indicating that a person uses another phone number or address, the interception may be extended to include the phone number or address by a decision of the director of that government agency, who will also notify the State Prosecutor. The State Prosecutor subsequently files the request for extension with the competent criminal court which will either render a new decision approving the extension or order the destruction of the materials collected (Article 169).

Police Act

(Official Gazette of the Republic of Serbia nos. 101/2005, 63/2009 and 92/2011, Zakon o policiji) (the “PA”)

The PA authorises the police to intercept electronic communications if such interception is necessary to arrest or apprehend a person under reasonable suspicion of having committed an offence punishable with imprisonment of four or more years and for whom an international arrest warrant is issued, if the police cannot apprehend such a person by other means or when other means would involve disproportionate difficulties.

The request for interception is submitted by the director of the police and approved by the president of the Cassation Court or, in the absence of the president of the Cassation Court, by a judge of the Cassation Court authorised to rule on such a request. Each interception may last up to six months, and may be extended by an additional six months.

Materials collected by an interception may not be used as evidence in criminal proceedings and must be submitted for destruction to the president of the Cassation Court, or the authorised judge of that court, immediately upon completion of the interception. In circumstances in which waiting for the court’s approval might jeopardise a police investigation, the interception may be ordered by a decision of the director of the police, with prior written approval of the president of the Cassation Court or the authorised judge of that court.  In such cases, the director of the police is obliged to submit to the court a written request for continued interception within 24 hours from obtaining prior approval. The court will decide on the continuation or suspension of the interception within 72 hours of receipt or the request (Article 83).

Security-Information Agency Act

(Official Gazette of the Republic of Serbia nos. 42/2002, 111/2009, 65/2014 and 66/2014, Zakon o bezbednosno-informativnoj agenciji) (the “SIAA”)

The SIAA provides for secret surveillance and recording of communications or surveillance of an electronic or any other address as special measures which may be employed against a person, group or organization under reasonable suspicion of undertaking or preparing activities which threaten the security of the Republic of Serbia. Such special measures may only be used when the circumstances of the case indicate that the suspected activities could not be discovered, prevented or proved by other means, or that other means would involve disproportionate difficulties or serious danger (Articles 13 and 14).  The SIAA does not define serious danger nor specify who should be in serious danger for these provisions to take effect.

Secret surveillance must be requested by the director of the Security-Information Agency and ordered by the president of the Higher Court in Belgrade (the “President“), or a judge of the special department of the Higher Court in Belgrade who handles cases of organized crime, corruption and other serious offences (the “Judge“) (Article 15). The interception may be ordered for a period of three months and, if necessary, may be extended up to three times, each time for a period of three months (Article 15a).

If, during the interception, the Security-Information Agency obtains information indicating that the subject of the interception is using other means of communication, the director of the Agency may  file a request for extension of the interception to include the discovered means of communications. If the President or Judge adopts this request, a new decision will be rendered approving the extension. If the request is rejected the collected materials must be destroyed (Article 15b).

Military Security Agency and Military Intelligence Agency Act

(Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA“)

Under the MSA, the Military Security Agency, which is in charge of security and counter intelligence protection of the Ministry of Defence and Military of the Republic of Serbia (Article 5), is authorised to secretly collect data as a special measure (including interception under the ECA), if data cannot be collected by other means or if collection by other means would cause disproportionate risk to the lives and health of people and property, or disproportionate expense (Articles 11 and 12).  Information may be collected for the purpose of preventing threats directed at the Ministry of Defence and the Military of the Republic of Serbia (Article 11, paragraph 2).

This measure can be applied on the basis of a written and reasoned decision of the Cassation Court in response to a request of the Director of the Military Security Agency and may be ordered for a period of six months, with the possibility of extension by an additional six months. (Articles 14 and 17).

Disclosure of communications data

Constitution of the Republic of Serbia

(Official Gazette of the Republic of Serbia no. 98/2006, Ustav Republike Srbije) (the “Constitution”)

With reference to Article 41 of the Constitution (described above), the Constitutional Court of Serbia issued a decision finding that derogation from the confidentiality of “other means of communications” includes not only interception of communications which would reveal the content of communications, but also the collection of metadata. Consequently, network operators and service providers must only disclose retained metadata on the basis of a court decision in accordance with Article 41 of the Constitution (Decision IUz-1218/2010 of the Constitutional Court of Serbia).

Electronic Communications Act

(Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

According to Article 128, paragraph 2, network operators and service providers are obliged to disclose retained metadata to government agencies (the police, the State Prosecutor, the Security-Information Agency and the Military Security Agency) that obtain a court decision allowing them such access for a limited period of time and for the purpose of conducting criminal proceedings or national security.

According to Article 128, paragraph 6 and Article 129, network operators and service providers are obliged to retain for a period of 12 months data:

  • tracing and identifying the source of a communication;
  • identifying the destination of a communication;
  • determining the beginning, duration and end of a communication;
  • identifying the type of communication;
  • identifying users’ terminal equipment; and
  • identifying the location of the users’ mobile terminal equipment.

Network operators and service providers must retain customers’ metadata for a period of 12 months and government agencies are only allowed to request access to such metadata.

Under Article 129, network operators and service providers must not retain the content of customer communications. Since, however, Article 128, paragraph 2, allows interception of electronic communications on the basis of a court decision, if such court decision contains an order for the retention of the content of electronic communications, then network operators and service providers would be obliged to act upon it.

Criminal Procedure Code

(Official Gazette of the Republic of Serbia nos. 72/2011, 101/2011, 121/2012, 32/2013, 45/2013 and 55/2014, Zakonik o krivičnom postupku) (the “CPC”)

Under the CPC, computer data searches of processed personal and other data may be employed as a special investigation measure covering the collection of metadata retained by a network operator or service provider, for the pre-trial and investigation phase of criminal proceedings.  These measures may be ordered in relation to a person suspected of committing or preparing a war crime, organized crime, cyber-crime or one of the listed serious crimes, if evidence of that crime cannot be collected in any other way or if gathering evidence by regular investigation measures would cause significant difficulties (Article 178).

The order for a computer data search is rendered by the competent court, upon the request of the State Prosecutor, for a period of three months with the possibility of up to two extensions, each time for an additional three months.

This measure is implemented by the police, the Security-Information Agency, the Military Security Agency, the customs, tax and other state authorities, or legal entities vested with official authority (Article 180).

Police Act

(Official Gazette of the Republic of Serbia nos. 101/2005, 63/2009 and 92/2011, Zakon o policiji) (the “PA”)

Under the PA, the police are authorised to obtain metadata relating to electronic communications if it is necessary for arresting or apprehending a person who is under reasonable suspicion of having committed an offence punishable with imprisonment of four or more years, and for whom an international arrest warrant is issued, if the police cannot apprehend such a person by other means or when other means would involve disproportionate difficulties.

The request for obtaining metadata relating to electronic communications is submitted by the director of the police and approved by the president of the Cassation Court or, in the absence of the president of the Cassation Court, by an authorised judge of the Cassation Court, within 72 hours of the receipt of the request. This measure may last up to six months, and may be extended by an additional six months.

Security-Information Agency Act

(Official Gazette of the Republic of Serbia nos. 42/2002, 111/2009, 65/2014 and 66/2014, Zakon o bezbednosno-informativnoj agenciji) (the “SIAA”)

Under the SIAA, obtaining metadata may be ordered as a special measure when the metadata relates to the communications of a person, group or organization under reasonable suspicion of undertaking or preparing activities which threaten the security of the Republic of Serbia, and the circumstances of the case indicate that their activities may not be discovered, prevented or proved by other means or that other means would involve disproportionate difficulties or serious danger (Article 13).

This measure must be ordered by the president of the Higher Court in Belgrade (the “President“), or a judge of the special department of the Higher Court in Belgrade who handles cases of organized crime, corruption and other serious offences (the “Judge“), upon the request of the Director of the Security-Information Agency (Article 15). The measure may be ordered for a period of three months and if necessary may be extended up to three times, each time for a period of three months (Article 15a).

If disclosed metadata indicates that an individual, group or organization is using other means of communication, the director of the Security-Information Agency may order extension of the special measure and subsequently file a request for extension of a measure in relation to the discovered means of communications. If the President or Judge adopts this request, he/she will render a new decision approving the extension. Where such a request is not adopted, the collected materials must be destroyed (Article 15b).

Military Security Agency and Military Intelligence Agency Act

(Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA“)

As mentioned above, under the MSA, the Military Security Agency is authorised to undertake the secret collection of data as a special measure in certain circumstances (Article 11). Secret electronic surveillance of electronic communications with the purpose of obtaining retained traffic data is a special measure requiring a written decision of the Cassation Court, rendered upon the request of the Director of the Military Security Agency and may be ordered for a period of six months, with the possibility of extension for an additional six months (Articles 14 and 17).

Technical Conditions

According to the Technical conditions for subsystems, devices, equipment and installations for mobile telecommunication networks no. 1-01-110-7/08 (“Mobile Technical Conditions”), the Technical conditions for subsystems, devices, equipment and installations for landline telecommunication networks no. 1-01-110-8/08 (“Landline Technical Conditions”) and the Technical conditions for subsystems, devices, equipment and installations for internet network no. 1-01-110-19/08 (“Internet Technical Conditions”) issued by the Electronic Communications Agency, network operators and service providers are obliged to remove their encryptions prior to delivery of the content of communications or metadata relating to communications to the competent government agencies (section 2 , Mobile and Landline Technical Conditions and Section 6, Internet Technical Conditions).

National security and emergency powers

Defence Act

(Official Gazette of the Republic of Serbia, nos. 116/2007, 88/2009, 88/2009 and 104/2009, Zakon o odbrani) (“DA”)

According to the DA, in a state of emergency or a state of war, legal entities in the postal-telegraph-telephone sector and other carriers of telecommunications systems must  prioritise the delivery of their services as specified by the Ministry of Defence (Article 73, paragraph 1). The Decision on establishing large technical systems significant for defence (Official Gazette of the Republic of Serbia, no. 41/2014) stipulates that Telenor d.o.o., as well as Telekom Srbija a.d, and VIP mobile d.o.o. are significant technical systems in the field of telecommunications which are required to adjust their systems to the needs of the defence system in Serbia.

Article 202 of the Constitution allows for the introduction of measures which would provide derogation from the general protection given to confidentiality of letters and other means of communication and protection of personal data (under Article 41 of the Constitution) in a state of emergency or war.  Government agencies may, on the basis of such measures, require access to a network operator’s or service provider’s customer communications data and/or network, without adhering to the procedure prescribed for obtaining these data in regular circumstances, that is, without presenting a court decision authorizing interception of electronic communications or access to the retained data.

Measures providing for derogation from Article 41 of the Constitution are adopted by the National Assembly or, if the National Assembly is not in a position to convene, by government decree with the President of the Republic as a co-signatory in the case of a national emergency (Article 200, paragraph 6 of the Constitution) or by the President of the Republic together with the President of the National Assembly and the Prime Minister in the case of a state of war (Article 201, paragraph 4 of the Constitution).

Measures providing for derogation from Article 41 of the Constitution in a state of emergency are effective for a maximum of 90 days, with the possibility of extension under the same terms. Measures providing for derogation from Article 41 of the Constitution in a state of war may continue as long as necessary, as decided by the National Assembly, or the government, if the National Assembly is not in a position to convene.

Police Act

(Official Gazette of the Republic of Serbia nos. 101/2005, 63/2009 and 92/2011, Zakon o policiji) (the “PA”)

In emergencies, the disclosure of metadata relating to electronic communications may be ordered by a decision of the director of the police, with prior written approval of the president of the Cassation Court or, in the absence of the president of the Cassation Court, by an authorised judge of the Cassation Court, in which case the director of the police is obliged to submit a written request to the Court allowing continued collection of metadata within 24 hours of obtaining prior approval (Article 83).

Military Security Agency and Military Intelligence Agency Act

(Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA“)

In emergencies, and particularly in cases of domestic and international terrorism, secret collection of data may be ordered by a decision of the Director of the Military Security Agency, with the interim prior approval of a judge of the Court of Cassation.  The decision will subsequently be assessed in more detail and the judge will either grant a continuation of the measure or terminate the measure within 24 hours of its commencement (Article 15).

Censorship Related Powers

Enforcement and Security Act

(Official Gazette of the Republic of Serbia, nos. 31/2011, 99/2011, 109/2013, 55/2014 and 139/2014, Zakon o izvršenju i obezbeđenju) (“ESA”)

There is no provision which explicitly regulates censorship and authorises government agencies to request censorship of customer communications.  However, network operators and service providers would be obliged to censor customers’ communication pursuant to the ESA, if such order were given by a competent court in the form of an interim measure or in the form of a final court decision.

Electronic Commerce Act

(Official Gazette of the Republic of Serbia, nos. 41/2009 and 95/2013, Zakon o elektronskoj trgovini)

According to the Electronic Commerce Act, internet service providers are obliged to implement court decisions on blocking IP addresses or restricting access to certain information society services provided by them (Article 21a). In addition, network operators that provide internet services to their customers are obliged to block IP addresses if an order is issued by a competent court in accordance with the ESA or in a final court decision rendered in both criminal and civil proceedings.

Electronic Communications Act

(Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

Article 127, paragraph 3, prohibits network operators and service providers from publishing records on requests received for interception which contain data identifying an authorised person who conducted the interception, the decision which provided the legal basis for interception and the date and time of the interception.

Oversight of the use of these powers

Judicial Oversight

Interception of electronic communications conducted by all government agencies authorised to undertake such interception and retention of the content of electronic communications are overseen by the competent court which ordered the measure and monitors its enforcement (Article 126, paragraph 1 and Article 128, paragraph 2 ECA; Articles 166 and 286 CPC; Article 83, paragraph 2 PA; Articles 15 and 16 SIAA; Articles 14 and 15 MSA). If materials obtained by interception were not collected in accordance with the prescribed procedure, the competent court will order their destruction (Article 163 CPC; Article 15b SIAA; Article 15 MSA).

Electronic Communications Act

(Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

The ECA contains provisions concerning the general oversight of network operators’ and service providers’ operations by the Agency for Electronic Communications (the “Agency“) and the Inspectorate of the Ministry of Trade, Tourism and Telecommunications (the “Inspectorate“).

At the request of the Agency, network operators and service providers are obliged to submit information on the protection of customers’ personal data and privacy (Article 41) and to correct irregularities in its technical and organizational settings (enabling interception) identified by the Agency and to inform the Inspectorate if a network operator or service provider does not comply with its request (Article 131).

The supervision of network operators and service providers is also conducted by the Inspectorate (Article 132 and Article 134, paragraph 1, subparagraph 6), which is authorised to order a network operator or service provider to remedy irregularities, oversights or omissions in its work within a given period of time (Article 135, paragraph 1, subparagraph 1).

The Ministry of Trade, Tourism and Telecommunications also monitors network operators’ and service providers’ assistance in implementing interception capabilities (Article 132 and Article 134, paragraph 1, subparagraph 6) and is authorised to order network operators and service providers to implement such capabilities within a given period of time and to temporarily suspend their activities if they do not comply (Article 135, paragraph 1, subparagraphs 1 and 3).

Network operators, service providers and government agencies are obliged to submit records in relation to requests received to access retained data in the preceding year on 31 January of each year to the Commissioner for Personal Data Protection. The Commissioner is authorised to order certain measures if data processing was not in accordance with the law (Articles 44, 45 and 56 of PDPA).

Police Act

(Official Gazette of the Republic of Serbia nos. 101/2005, 63/2009 and 92/2011, Zakon o policiji) (the “PA”)

According to Article 171, police activities are generally supervised by a special department of the Ministry of Police – the Division of Internal Control, which monitors the legality of police work, especially with regards to respect and protection of human rights in the performance of police tasks and applying police powers.

Military Security Agency and Military Intelligence Agency Act

(Official Gazette of the Republic of Serbia nos. 88/2009, 55/2012 and 17/2013, Zakon o vojnobezbednosnoj agenciji i vojnoobaveštajnoj agenciji) (the “MSA“)

Article 57 provides for internal control of the Military Security Agency, conducted by the Division of Internal Control of the Military Security Agency. There is also political supervision over the work of the police, the Security–Information Agency and the Military Security Agency by the National Assembly and the government (Article 17 SIAA and Article 57 MSA).

Constitution of the Republic of Serbia

(Official Gazette of the Republic of Serbia no. 98/2006, Ustav Republike Srbije) (the “Constitution”)

The Constitutional Court of Serbia, which is authorised to assess constitutionality and legality of laws and other general acts, may find that a measure of derogation from confidentiality of letters and other means of communication and protection of personal data introduced during a state of war or emergency is unconstitutional (Article 168).

Law on Constitutional Court of Serbia

(“Official Gazette of the Republic of Serbia, nos. 09/2007, 99/2011 and 18/2013, Zakon o ustavnom sudu)

Network operators and service providers may file a constitutional appeal against a decision of a government agency as an individual act which violates Constitutional guarantees, when other legal remedies have been exhausted or are not prescribed or where the right to their judicial protection has been excluded by law (Articles 82 and 83).

Publication of laws and aggregate data relating to lawful intercept and communications data requests

There is no law prohibiting the publication of any of the laws mentioned in this report or any description of the powers set out in any of those laws.

Electronic Communications Act

(Official Gazette of the Republic of Serbia nos. 44/2010, 60/2013 and 62/2014, Zakon o elektronskim komunikacijama) (the “ECA”)

Article 27, paragraph 3 of the ECA prevents network operators and service providers from publishing records of requests for interception or access to metadata that provide information on: the identity of the persons conducting the interception or who gained access to the metadata, the identity of the people whose communications were intercepted or whose metadata was accessed, the purpose of the interception or access, or the time and place of the interception or access.

This would not, however, prevent network operators or service providers publishing aggregate data on the number of requests to intercept communications for example, provided that none of the above information is included in this publication.

Law stated as at 20 January 2015.

This information was originally published in the Legal Overview to the Telenor Group report on Authority Requests for Access to Electronic Communication in May of 2015.

Social

Follow us on Twitter @IndustryDialog