1. Scope of Study

The objective of this study was to examine certain issues raised by the need to combat criminal activities perpetrated over communication networks, such as the Internet. The perspective guiding the study was a recognition that law enforcement agencies faced significant new challenges when trying to carry out an investigation in such networked environments. The extent to which such problems could be addressed through the granting of new powers of investigation was to be considered.

Any criminal investigation interferes with the rights of others, whether the person is the subject of the investigation or a related third party. In a democratic society any such interference must be justifiable and proportionate to the needs of that society to be protected from such crimes. The study attempts to gauge the emerging needs of law enforcement agencies balanced against the rights of individuals, as recognised in the European Convention on Human Rights; as well as the interests of third party communications service providers, as the intermediaries which build and operate the networks over which criminal activities are being carried out.

The purpose of any criminal investigation is to obtain sufficient evidence of the illegal activity to enable the perpetrator to be identified and subjected to criminal proceedings. The evidence being sought will usually extend to the activities of the perpetrator in carrying out his crime (eg. downloading images), the actual offence itself (eg. the virus) or the effects of the criminal activity (eg. the damaged system). In a networked environment, such evidence may be obtained from items in the possession of the accused; the victim(s) or a third party. A communication service provider, as the third party relevant to this study, will be processing evidentially relevant data either in the course of providing the service itself (eg. transmission) or on its own behalf (eg. billing data).

The conclusions and recommendations of this study can be broadly sub-divided in two categories. First, general issues of principle are addressed in terms of the appropriate framework to deal with certain aspects of criminal investigations in a networked environment: access to stored data, access to protected data and distinctions between communications content and communication attributes. These issues are primarily concerned with achieving a balance between the interests of law enforcement agencies and those subject to the investigation, primarily the rights of individuals. Second, the potential impact that the legal regimes addressing these three areas of study may have on the providers of the communication services and networks that comprise the networked environment.

The existence of appropriate substantive offences within Member States, addressing both traditional criminal activities (eg. fraud and pornography) and novel threats (eg. ‘hacking’ and viruses), was beyond the scope of this study.

The transnational nature of many communications networks raises complex issues relating to the exercise of law enforcement powers across multiple sovereign jurisdictions. The establishment of appropriate procedures for co-operation between states has been the subject of recent agreement at a European Union level as well as within other international forum. The study has therefore limited its consideration of those issues subject to such agreements.

2. Study Methodology

One of the key elements of this research was an examination of the attitude and perceptions of Communication Service Providers (CSPs) with respect to their role in the investigation of computer crime. The study has utilised two main sources of information in this regard: publicly available materials and face-to-face interviews. The former was greatly assisted by the fact that, during the period of the study, the UK was in the process of adopting new legislation in the area: The Regulation on Investigatory Powers Act 2000. As a consequence, a considerable amount of public debate took place, and much literature was generated, concerning the potential impact that such legislation would have on CSPs and their response to the issues raised.

A survey was prepared and distributed to CSPs (see Appendix I.3). However, the response was very disappointing both in terms of the numbers of replies and the quality of information garnered from the submissions. The study therefore engaged in a series of face-to-face interviews with a representative sample of CSPs operating within Europe. Whilst such interviews do not generate any quantitative data, due to the sample size; they do provide an extremely valuable qualitative insight into the issues faced by CSPs in respect of the area of study. It was also possible to validate the responses of the interviewees against the publicly available material referred to above.

The CSPs who participated in the interview process (see Appendix I.1 - confidential to the contractors and the European Commission) were approached on the basis that they represent some of the main categories of player within the burgeoning market for communication services:

• A traditional incumbent operator, with a broad retail consumer base in the provision of both voice and data services;
• a provider of mobile wireless voice and data retail services throughout Europe;
• a provider of network infrastructure to the non-consumer market throughout Europe, primarily for data traffic;
• providers of retail data communication services to consumers and corporate users throughout Europe; and
• a provider of data communication facilities to the providers of data communication services to the public.

The responses of the interviewees have been consolidated into a report appended to the Final Report: Appendix I.2.

The study also distributed a survey to law enforcement agencies to contacts both within Europe and other jurisdictions (see Appendix II.3). Whilst the numbers of responses were greater than those received from CSPs, the quality of information supplied was again somewhat disappointing. The feedback from the survey was therefore supplemented by face-to-face interviews with officers from several of the law enforcement agencies surveyed (see Appendix II.1). The results of the surveys and interviews have been consolidated into a report appended to the Final Report: Appendix II.2.

During the course of the study, data was obtained about the relevant legislative regimes in a range of jurisdictions. This information is presented in Appendix IV in both country-by-country and in a tabulated comparative form.

The opinions expressed in this study are those of the authors and do not necessarily reflect the views of the European Commission.

ECSC-EC-EAEC, Brussels, Luxembourg (2000).

3. Access to Stored Data

Law enforcement agencies generally have sufficient powers to search premises and seize relevant materials, subject to restrictions on obtaining certain types of data, such as legally privileged material. An issue in the seizing of computer-derived evidence is the volume of potentially relevant material, which makes the task of sorting protected material from non-protected material substantially more complex. The issue of obtaining access to protected material is addressed in Section 4 below.

This study has identified two key issues in relation to law enforcement access to stored information:

• A third party communications service provider (CSP) may store evidentially relevant data for certain periods of time, arising directly or incidentally from their processing of the data in the normal course of business. Access to such data may inevitably assist a criminal investigation. The period for which the data is stored will be dictated both by the technical set-up of the system in question, as well as the governing legal framework.

• One CSP noted that they did not currently record Internet log-on session data, i.e. content or traffic data relating to the use of Internet services; while
• a respondent in the mobile market stated that it stores no data, but simply "operates a straightforward switching network".

• Communication service providers should not be required to systematically retain communication attributes data or communications content solely for law enforcement purposes.

• Communication service providers should have obligations to establish procedures for responding expeditiously to appropriately authorised requests by an investigating authority to retain specifically identifiable data.

• Further study is required into the costs of establishing such data retention procedures.

• Where the stored material is stored on a system physically located in another jurisdiction, the powers of the investigative authorities to seize such material will clearly be subject to restrictions arising from issues of sovereignty. Both the draft Cybercrime Convention and the draft Mutual Assistance Treaty address this issue. However the nature of a networked environment will generally mean that evidence derived from remote systems will not be subject to seizure by an authority, rather a copy of the information will be made of the relevant data. In this sense, the ability to copy digital information means that law enforcement agencies have greater flexibility in obtaining computer-derived evidence than obtaining items in a physical environment, subject to the need to ensure the forensic integrity of such intangible evidence.

• Member States should grant properly authorised law enforcement agencies the power to gain access to non-public data held on remote systems within their sovereign jurisdiction.

• Where the material is held on a system under the control of a third party, such as a CSP, then such parties should be under an obligation to provide all reasonably practicable assistance to gain access to the relevant material.

• Law enforcement agencies will need to be both appropriately trained to carry out forensic investigation across communications networks, including obtaining access to remote systems; and or should have access to expert resources to assist them to engage in such activities.

4. Access to Protected Data

As discussed above, evidentially-relevant data may be obtained through intercepting a communication session or from a party who has stored the data. However, the data once obtained may be in a form that is designed to protect it from being disclosed to third parties; for example, data can be encrypted in order to ensure its confidentiality. Users of communications networks are increasingly aware of the need to implement such data security techniques, to meet both their own operational and commercial needs as well as statutory obligations designed to protect the rights of third parties: eg.

The nature of data security technologies means that investigating authorities have essentially three options in respect of gaining access to the protected data:

• Require the person from whom the data has been obtained to convert the data into an intelligible plain-text format;
• require the person to disclose the necessary information and, or, tools to enable the authorities to convert the data into a legible format themselves; or
• utilise technologies and techniques which enable the data to be converted without the active involvement of the person from whom the data was obtained.

The first option represents standard criminal procedure among the Member States. Under the second option, proposals have been made in some jurisdictions for specific requirements to deliver up ‘keys’ to render data intelligible:

1. allows access to the electronic data, or
2. facilitates the putting of the data into an intelligible form".

Such an obligation differs from the approach taken in traditional investigations. Criminal procedures do not, generally, contain express requirements to provide, for example, the combination to open a metal safe. However, modern data security techniques have been seen by some policy-makers as requiring a specific legislative response. In contrast, some jurisdictions have legislated expressly against such a requirement. Such a divergence of approach between Member States may have consequences for the development of the Single Market.

In addition, a number of distinctions need to be recognised in relation to the second option. First, the data security technique being delivered up may either be specific to an individual or it may be a tool that protects the data of a community of users, such as a company’s employee email over an Intranet. In the latter scenario, the obligation to disclosure gives rise to potential vulnerabilities both in terms of the individual rights of others, ie. other protected users, and the interests of legal entities, ie. the corporation. Under European Convention jurisprudence, the potential for collateral infringements of third party privacy rights must be necessary and proportionate to the object of the interference. The potential exposure of the corporate entity to a breach of its security may have significant consequences for its commercial activities, particularly in relation to adverse publicity and perceptions of trust. Such concerns have historically meant substantial under-reporting of computer crimes, such as hacking and fraud.

Second, the person subject to the requirement may be the person under investigation or a related third party, such as a company or communications service provider. Again, where the requirement is imposed on a third party, adequate consideration needs to be given to the costs, in the widest sense, being imposed on that third party. For example, in terms of CSPs, a requirement to disclose keys protecting the data of its customers could restrict the growth of the market for services such as ‘key escrow’, where a third party maintains copies of cryptographic keys as a safeguard against loss or destruction. The needs of law enforcement could, therefore, be facilitating against the use of data security services that are seen as being critically important to the development of an ‘Information Society’.

Third, the security technique may be operational for a single communication session (eg. a ‘nonce’ cryptographic key) or for a particular user or application over a period of time. In the latter case, where the disclosure is made by a third party without the knowledge of the investigated subject, investigators will be able to access not only prior data but also any future data that may be communicated. In terms of interference with an individual’s private life, the threat posed by on-going access requires that investigative authorities be subject to appropriate additional procedural controls.

Another concern regarding the second option is that certain data security techniques may be utilised for the provision of different security functions. For example, a cryptographic key may be used for digitally signing data, achieving authentication and integrity functions, as well as for confidentiality purposes. In such circumstances, the obligation to deliver-up the tool should only be applicable where the tool had been used for the latter purpose.

The viability of the third option, converting the data into an intelligible form through utilising available techniques, would seem to depend on a number of factors, including the strength of the technology used by the party applying the security technique; the functionality of future technology, and the period within which the data realistically needs to be converted. In the longer term, it will depend on future developments in technology since techniques may be developed which are essentially incapable of being overcome. However, some governments have recognised the need to establish some such ‘in-house’ technical capability to assist law enforcement investigations.

Where a legal obligation is imposed upon a person in relation to an investigation, a failure to comply will inevitably result in sanctions. Such sanctions may comprise either the commission of a separate offence; an offence related to the exercise of the enforcement powers, or some form of adverse or incriminating inference raised in the course of any subsequent related criminal proceedings, eg. possession of obscene material. The latter approach may be statutorily based, as in the United Kingdom, or may comprise a factor in civil law jurisdictions where evidence is freely assessed with regard to all relevant circumstances, including the behaviour of the accused.

Where an offence is committed through non-compliance with a lawful requirement, any penalty will need to act as an appropriate deterrent against such a refusal to comply. However, in certain circumstances, it is likely that a person may choose not to comply with the request to disclose, thereby accepting the penalty, rather than comply and potentially expose themselves to prosecution for a more serious offence with greater penalties. Whilst such a scenario may be unfortunate, it would seem be a necessary comprise where the rights of the individual are balanced against the need to protect society.

The raising of an adverse inference against a person in criminal proceedings for a failure to supply certain information (under the first two options above) could raise issues concerning the right to a fair trial, under Article 6 of the European Convention on Human Rights. In particular, it may be viewed as an infringement of the individual’s right to silence, right not to self-incriminate and the principle that the prosecution has the burden of proving a case. Convention jurisprudence indicates that whilst a conviction may not be based solely or mainly on a refusal to supply such information, an adverse inference may in specified circumstances be drawn from such a refusal when assessing the evidence adduced by the prosecution.

Recommendations:

• The use of data security techniques to protect data must be further encouraged in order to minimise the vulnerabilities of the Information Society.

• Measures should be taken to enable appropriately authorised law enforcement agencies to require a party, under investigation in relation to specified offences, to provide data in an intelligible form, subject to rules governing certain types of data (eg. legal professional privilege) and in compliance with the principle against self-incrimination.

• The Commission should consider the need to harmonise the approach of Member States to the issue of law enforcement access to data security techniques, such as encryption keys. The absence of a harmonised approach may inhibit the development of an Internal Market for such products.

• Appropriate measures must be implemented to ensure that the rights and interests of parties not subject to the investigation, such as a CSP, a business or individuals, are not adversely effected.

5. Content and Communications Data

Historically, national legal systems have distinguished between the interception of the content of a communications and the data related to the communication session itself, ie. its attributes, such as telephone numbers and call duration. Such a distinction would seem be based on a popular perception that access to the content of a communication represents a greater threat to personal privacy than access to the related communications data. Such a sentiment can be found in the European Court of Human Rights:

However, developments in telecommunications would seem to have led to a qualitative and quantitative shift in the nature of data being generated through the use of communications technology. For example, mobile radiotelephony generates data relating to the geographical position of the user, which is enabling the development of a range of location services.

To date, the European Court of Human Rights has not been required to address the distinction between the obtaining of communications content and its associated attributes in terms of the application of Article 8. It can be expected, however, that Member States will be obliged to meet similar objective criteria (‘in accordance with the law’) in respect of access to communications data as exist for communications content.

Whilst EU data protection law recognises no distinction in the treatment given to communications data and content, the particular privacy threats raised by communications data is specifically addressed in Directive 97/66/EC on data protection in the telecommunications sector. The Directive distinguishes between ‘traffic data’ and ‘billing data’. The former comprises that data which "is processed to establish calls and stored" by the CSPs involved. The term ‘call’ has been seen as being restricted to voice telephony, the Commission has therefore proposed that the scope of the provision be broadened: "processed for the purpose of the transmission of a communication". ‘Billing data’ comprises both ‘traffic data’ and data relating to the subscriber to whom the CSP supplies the service.

It would seem to be arguable that the threat to individual privacy from obtaining communication attributes data as opposed to communications content is of similar importance in modern network environments. However, although there would appear to be no current requirement in Member States laws to treat access to such categories of data under a similar legal regime, the Commission has recently proposed such equality of treatment:

In contrast, whilst ECHR jurisprudence addresses the need to have a clear and accessible legal framework for the protection of privacy, it has not considered the issue in a comparative sense: whether particular threats to privacy must be treated in a similar way by national legislation.

The main issue raised by differential legal treatment is that in modern communications networks the distinction between communication attributes and content is becoming increasingly blurred. A web-based Uniform Resource Locator (URL), for example, contains not only details of the IP address of the web site being accessed, akin to a traditional telephone number; but will also often contain further information in relation to the content of the requested communication, eg. a particular item held on the site or a search string will contain the embedded parameters of the search. The introduction of touch-tone technology has also enabled an individual to key in his credit card details when using a telephone banking service; although the keyed in data may redirect a call to another switch, a technique often used by ‘hackers’ to obtain fraudulent access to communications services. Such so-called ‘post-cut-through’ data render any legal categorisation based on a technical distinction between signalling and content channels unworkable.

Under US law, a distinction is made between communications content and ‘call-identifying information’, which is defined as follows:

From a law enforcement perspective, the communications attribute of primary interest in an investigation is such identifying information. Whilst this would seem a relatively clear statutory definition, a decision by the Federal Communications Commission to encompass ‘post-cut-through dialed digit extraction’ within this definition was recently overturned in the Appeals Court partly on the basis that "there is no way to distinguish between digits dialed to route calls and those dialed to communicate information".

In the UK, the distinction is made between the communication and ‘traffic data’:

Sub-section (c) is designed to cover situations of ‘dial-through fraud’, where calls are re-routed over circuit-switched networks to avoid service charges. However, it would seem to be so broadly defined that it potentially covers any signals sent using touch-tone technology, such as bank account details which should more appropriately be treated as content. The final phrase of the definition is designed to limit the concept of ‘traffic data’ in an Internet-context to the apparatus identified by the IP address and not any files or programs stored on the machine.

Under UK law, ‘traffic data’ is a sub-set of a broader categorisation of data, ‘communications data’, which also includes data relating to usage of the communications service, eg. call duration, and other information concerning the person to whom the CSP provides the service, eg. subscriber address details. Access to such data is subject to a different regime than that applicable to communications content.

The Council of Europe draft Cybercrime Convention also uses the term ‘traffic data’:

Finally, the European Commission has also recently proposed a regulatory definition of ‘traffic data’ for data protection purposes:

Such a broad definition does not enable a clear distinction to be drawn between the content of a communication and its related attributes; although such a distinction is not necessarily problematic from a privacy protection perspective. However, the existence of different regulatory definitions of ‘traffic data’ within the European Union could give rise differential treatment in the Member States, which could create legal uncertainties for all concerned.

In the URL example given above, how would such ‘call-identifying information’ or ‘traffic data’ be technically separated from associated content, such as file details? Reliance on the agencies themselves to distinguish such data would seem unacceptable, which requires us to consider the role of the CSP over whose network the data is being sent during the interception process. To safeguard the rights and freedoms of the individual, the relevant CSP would need to be able to identify the relevant data and then automatically separate ‘call-identifying’ information for forwarding to the appropriate requesting authority. Under US law, such an obligation in enshrined in the law:

However, the technical feasibility of such approach requires further examination, as well as the costs and how they are distributed.

If the access to communication data is subject to less onerous legal protections than that required for content, the potential consequences of the blurring between communication attributes and content in a modern communications environment are numerous:

• An individual’s rights in the content of their communications may be significantly eroded;

• CSPs will face legal, procedural and operational uncertainties with regard to the obligations to obtain and deliver-up data that has been requested by an investigating agency; and

• law enforcement agencies will be faced with greater legal uncertainties in respect of the appropriate procedures to be complied with when carrying out an investigation.

Recommendations:

• Access by law enforcement agencies to ‘communications data’ should be subject to similar legal controls as present for access to the content of a communications.

• Further consideration should be given to the technical feasibility of distinguishing between content and communications data in the course of an investigation.

6. Communication Service Providers

One dominant feature of a modern communications environment is the proliferation of communications service providers and networks utilising alternative access technologies, both wireline and wireless. As a consequence, it can be assumed that most communications will be transmitted across a number of different networks owned and, or, operated by different legal entities. As such, relevant evidence may be obtained at various points within the network.

In a traditional voice telephony environment, the general principle was that an interception would be carried out as physically close to the suspect as possible, which usually meant at a local loop or exchange level. In the current environment, the principle is no longer necessarily applicable as the proliferation of ‘intermediary service providers’ within the network hierarchy structure presents a range of alternative points of interception, particularly in respect of certain types of communications (eg. remote mailbox and cached web pages).

Historically, in order to enable law enforcement agencies to intercept communications, communication service providers have had legal obligations to maintain the technical capability to intercept communications. An issue presented by the current communications environment is whether such obligations should be extended to the new types of communication service providers that have entered the marketplace and the scope of any such obligation. A number of Member States have already addressed this issue (e.g. Germany: Telecommunications Law, para. 88; UK: Regulation of Investigatory Powers Act 2000, s. 12; Netherlands: Telecommunications Act 1998, s. 13), but significant national differences exist across a number of issues: eg.

• Whether an ‘intercept capability’ should be imposed upon all providers of communication services and networks or only providers of ‘public’ services and networks;

• whether an ‘intercept capability’ should be imposed upon providers of communication networks, rather than providers of communication services;

• whether the ‘intercept capability’ should enable LEAs direct access to the point of intercept, without the involvement of CSP personnel; and

• who should bear the cost of implementing an ‘intercept capability’?

Law enforcement agencies are inevitably keen to have access to the widest range of possible sources of relevant evidential data.

The survey of CSPs has identified two key concerns arising from an obligation to ensure an ‘intercept capability’. First, considerable reservations have been expressed about the feasibility of achieving a stable ‘intercept capability’ solution in a rapidly evolving communications environment. ‘Intermediary service providers’ in particular are concerned that their freedom to design, build and operate innovative data communications networks and services, in accordance with the dictates of newly available technologies and commercial imperatives, would be significantly restrained by the need to meet an on-going obligation to ensure an ‘intercept capability’. In addition, at the level of the traditional circuit-switched local access network, significant change will be experienced as a result of the regulatory drive within Europe to unbundle the local loop, to encourage the roll-out of broadband communication facilities. It is generally accepted that a single technological solution to the requirement for ‘intercept capability’ is not going to be available, which will have associated cost implications for CSPs and potentially procedural implications for law enforcement agencies.

Second, the costs arising from compliance with an obligation to provide ‘intercept capability’ is an important factor. Such costs can be distinguished into fixed costs, in relation to building the ‘capability’ into the network (eg. switches with intercept functionality), and variable costs, arising from the operational aspects of carrying out an interception (eg. personnel). It is beyond the remit of this study to determine the most appropriate division of costs between Member State governments, as holders of public funds, and the providers of communication networks and services. In many jurisdictions, fixed costs are borne by the CSP, whilst variable costs are covered by the relevant public authority. Both CSP and LEA respondents to the study noted that shifting some of the financial cost arising from an investigation to the investigating agency acted as a effective restraint on the use of such techniques.

Significant concerns have been expressed, however, particularly by those representatives of newly emerged ‘intermediary service providers’, that the costs involved in implementing ‘intercept capability’ in modern communication networks are likely to be substantial. Such concerns have been reflected in some jurisdictions through express statutory reference to the parties required to bear the costs: E.g.

• In the UK, the Regulation of Investigatory Powers Act 2000 provides that a CSP "receives such contribution as is…a fair contribution towards the costs incurred" (s. 14(1));
• in the Netherlands, the Telecommunications Act 1998 enables CSPs to "claim compensation from the national treasury for the administrative and personnel costs incurred by them directly" (art. 13.6.2)

Were the costs associated with the provision of ‘intercept capability’ to lie exclusively with the communication service providers, then this may impact on the commercial viability of certain SMEs entering the market for the provision of communication services and networks. The imposition of onerous ‘intercept’ obligations upon CSPs within Europe, in comparison with other jurisdictions, may also have an adverse effect on where CSPs choose to establish their business in the medium to long term.

7. FINAL CONCLUSIONS AND RECOMMENDATIONS

• The imposition of differential requirements upon CSPs, in respect of the provisioning of ‘intercept capability’, between Member States constitutes an obstacle to the development of pan-European electronic communications networks and services.

• The broad imposition of an ‘intercept capability’ upon all providers of communication services and networks would be detrimental to the development of a competitive market. A specific obligation should only be imposed upon those controlling communication networks.

• Further study needs to be carried out into the technical feasibility and associated costs of carrying out interception at different points within the network hierarchy.

• An advisory forum should be established, at a European Union level, to establish an effective on-going dialogue between law enforcement agencies, communication service providers and bodies capable of representing the interests of individual users.

• The Europe Union should encourage further agreement at an international level as to the appropriate regime for the imposition of ‘intercept capability’ upon communication service providers.

• Communication service providers should not be required to systematically retain communication attributes data or communications content solely for law enforcement purposes.

• Communication service providers should have obligations to establish procedures for responding expeditiously to appropriately authorised requests by an investigating authority to retain specifically identifiable data.

• Further study is required into the costs of establishing such data retention procedures.

• Member States should grant properly authorised law enforcement agencies the power to gain access to non-public data held on remote systems within their sovereign jurisdiction.

• Where the material is held on a system under the control of a third party, such as a CSP, then such parties should be under an obligation to provide all reasonably practicable assistance to gain access to the relevant material.

• Law enforcement agencies will need to be both appropriately trained to carry out forensic investigation across communications networks, including obtaining access to remote systems; and or should have access to expert resources to assist them to engage in such activities.

• The use of data security techniques to protect data must be further encouraged in order to minimise the vulnerabilities of the Information Society.

• Measures should be taken to enable appropriately authorised law enforcement agencies to require a party, under investigation in relation to specified offences, to provide data in an intelligible form, subject to rules governing certain types of data (eg. legal professional privilege) and in compliance with the principle against self-incrimination.

• The Commission should consider the need to harmonise the approach of Member States to the issue of law enforcement access to data security techniques, such as encryption keys. The absence of a harmonised approach may inhibit the development of an Internal Market for such products.

• Appropriate measures must be implemented to ensure that the rights and interests of parties not subject to the investigation, such as a CSP, a business or individuals, are not adversely effected.

• Access by law enforcement agencies to ‘communications data’ should be subject to similar legal controls as present for access to the content of a communications.

• Further consideration should be given to the technical feasibility of distinguishing between content and communications data in the course of an investigation.

• The imposition of differential requirements upon CSPs, in respect of the provisioning of ‘intercept capability’, between Member States constitutes an obstacle to the development of pan-European electronic communications networks and services.

• The broad imposition of an ‘intercept capability’ upon all providers of communication services and networks would be detrimental to the development of a competitive market. A specific obligation should only be imposed upon those controlling communication networks.

• Further study needs to be carried out into the technical feasibility and associated costs of carrying out interception at different points within the network hierarchy.

• An advisory forum should be established, at a European Union level, to establish an effective on-going dialogue between law enforcement agencies, communication service providers and bodies capable of representing the interests of individual users.

• The Europe Union should encourage further agreement at an international level as to the appropriate regime for the imposition of ‘intercept capability’ upon communication service providers.