Tag Archives: Eneli Laurits

Yearbook of Estonian courts 2015

estonian_courts_yearbook_2015
The focus of this Yearbook is on criminal procedure with special emphasis on surveillance operations. There are three articles that are of our interest.

“Supervision over surveillance”, Uno Lõhmus, Visiting Professor at the University of Tartu:

In conclusion
First, full judicial pre-approval of surveillance operations, judicial supervision of the operations at the time of conduct thereof, and effective review of the operations after their completion are not ensured. Second, the rules on surveillance are laconic, incomplete and ambiguous, and the case law has not been able to improve this situation. In other words, legal clarity of the law is not ensured. This adds to the complexity of judges’ work and may also contribute to superficiality.
…
In addition, the case law does not clarify whether the installation of spyware in a computer system should be regarded as the installation of a technical means.
…
As of 1 January 2013, examination of traffic and location data in electronic communication is not considered to be a surveillance operation.

“Problems related to surveillance – the perspective of a defence counsel”, Küllike Namm, attorney-at-law:

In conclusion
This article focuses on the questions that have arisen in connection with surveillance operations and to which the current law does not provide answers. The discussion of these issues is intended to point out that the activities of public authorities in organising surveillance are inadequately regulated by the Code of Criminal Procedure. This creates a situation where the provisions on access to information on surveillance operations do not guarantee that a person subjected to surveillance can examine the data collected by surveillance operations and, where necessary, take possession of the data in a format that can be played back.

“Some problems encountered in computer system searches”, Eneli Laurits, Adviser to the Penal Law and Procedure Division of the Ministry of Justice:

Summary
The Code of Criminal Procedure of Estonia does not regulate computer system searches. It is relatively difficult to apply the existing rules to the collection of evidence in the manner described in this article, but it is still possible.
…
When performing an inspection, the body conducting proceedings is not entirely free of jurisdiction-related issues: for example, if the object of inspection is the social media website of a victim or a suspect, then the inspection of the website is complicated in theory, but simple in practice – a mouse click is enough to display various data within the territory of Estonia. An inspection can be based on cooperation (the subject voluntarily provides the user IDs and passwords), but there is always the possibility that voluntary cooperation fails. An investigative body should be able to rely on a legal regime in such cases.

Links:
http://www.riigikohus.ee/vfs/2071/Riigikohtu_aastaraamat_eng_veebi.pdf

Criminal procedure and digital evidence in Estonia by Eneli Laurits

Leave a reply

digital_evidence_and_electronic_signature_law_review

It has been decided in Estonia that by the year 2020, a criminal file may be digital. Following on from this decision, it is necessary to decide how to incorporate into the law a regulation concerning digital evidence with the aim of seizing as much as possible evidence in its initial digital form, and ensuring the evidence is seized in the place where it is physically located.
…
This article aims to sum up the most common activities within which digital evidence might be taken, highlighting the potential problems of interest to the legislature when elaborating specific regulations for digital evidence.

Quite disturbing revelation is that by the current law, the law enforcement agents, after court authorized inspection, seizure or remote take-over of the computer system, are allowed to access any other remote resources that the system has access to:

The Advisory Guidelines on IT-Evidence, prepared on 24.05.2016 by law enforcement agencies, claim that in case of public investigative measures (inspection, search) and covert surveillance, no request for legal assistance is needed for data stored in cloud on foreign states’ servers.
…
For example, upon apprehension, a suspect has a computer or a smartphone unprotected with a password, and it is possible to obtain and to look through the information about the data stored, for example, in the cloud or in an e-mail box (which are not on the Estonian servers). Even when prosecutors approach the court on their own initiative, and by pointing out an obvious similarity between the search of a computer system and the search of a physical space to obtain permission from the court, preliminary investigation judges have so far found that such permission is not needed.
…
The Supreme Court has found that a permission granted by a prosecutor, and not by a court, is enough to observe, copy data in the person’s e-mail box (including when an e-mail box is located on a foreign state’s server) and to covertly examine a part of the server where a particular e-mail box is located, because messages are then not being transmitted, but they have already reached a recipient.

Links:
http://journals.sas.ac.uk/deeslr/article/download/2301/2254

Interdisciplinary Cyber Research workshop 2015

Leave a reply

TTU_centre_for_digital_forensics_and_cyber_security

18th of July, 2015 — Tallinn, Estonia

The aim of the workshop is to bring together young as well as established scholars undertaking research in various disciplines related to information and communication technologies such as computer sciences, political and social sciences, and law. Attending the ICR workshop is free of charge and also open for participants who have not submitted an abstract (registration for non-authors is here). Travel to/from Tallinn and accommodation is to be covered by the participants.

Agenda:
9:30 – Opening words, Tallinn University of Technology
9:35 – Keynote presentation, “Data Sovereignty, Data Flow, and International Jurisdiction in Cloud Computing, Prof Christopher Millard, Queen Mary University of London
10:05 -Keynote presentation, “Gnawing Away at Internet of Things Silos”, Prof Jon Crowcroft, University of Cambridge
Session 1: State and Cyber (Room 1)
“Governance of Cyber-Security in Elections”, Prof Robert Krimmer, Tallinn University of Technology
“E-Estonia under an Actor Network Theory Perspective”, Carlos Vargas Alvarez Del Castillo, Tallinn University
Session 2: Education and Digital Safety (Room 2)
“Representation of Snowden ́s Scandal in Estonian Media: Semiotic Logic of Fear”, Mari-Liis Madisson, University of Tartu
Session 3: Privacy (Room 1)
“Tor Does Not Stink: Use and Abuse of the Tor Anonymity Network from the Perspective of Law”, Tomas Minarik, NATO CCD COE
Session 4: Tech I (Room 2)
Session 5: Law (Room 1)
“ISP Liability & the Delfi case”, Karmen Turk, University of Tartu
Session 6: Tech II (Room 2)

Registration deadline for non-authors: 10th of July 2015

Links:
http://cybercentre.cs.ttu.ee/en/icr2015/