The Swiss Federal Council, based on the Federal Act of 18 March 20161 on the Surveillance of Post and Telecommunications (SPTA), ordains: |
Chapter 1 General Provisions |
Section 2 Surveillance Order |
Art. 3 Submissions to the PTSS
1 The ordering authority shall use one of the following transmission channels to submit surveillance orders and orders for their extension or termination to the PTSS and to notify it of the access rights to be established:
2 The PTSS may replace the means of transmission of submissions in accordance with paragraph 1 letter a with online-access to the Service’s processing system. |
Art. 4 Conduct of surveillance
1 The PTSS shall determine in specific cases the technical and organisational measures for conducting surveillance, unless these are directly specified in the applicable regulations, in particular for standardised types of information and surveillance. 2 If as a result of operational problems a person or entity required to cooperate is unable to meet its obligations for the surveillance of post or telecommunications, it shall report this to the PTSS without delay and thereafter submit a written statement of the reasons. The PTSS shall inform the person or entity required to cooperate without delay if surveillance cannot be carried out because of operational problems on its side. 3 Irrespective of where the cause of the error lies, the person or entity required to cooperate must temporarily store at least the undelivered secondary telecommunications data from real-time surveillance and deliver it without delay. If the secondary telecommunications data from real-time surveillance is no longer available or incomplete, the person or entity required to cooperate must deliver without delay the secondary telecommunications data from retroactive surveillance in accordance with the instructions of the PTSS. |
Art. 5 Protection of official or professional secrecy
If the PTSS establishes that the surveillance relates to a holder of official or professional secrets but that the statutory measures to protect these secrets have not been taken, it shall in the following situations notify the ordering authority and the approval authority without delay and initially shall not allow the former and the persons named in the surveillance order access to the surveillance data:
|
Art. 8 Recording telephone calls as evidence
1 The PTSS shall record as evidence the telephone calls made in connection with its duties. 2 Any evaluations of the recording shall be carried out by Data Protection Commissioner or the PTSS Data Protection Commissioner. 3 The PTTS shall retain the recorded telephone calls for two years and thereafter destroy the recordings. |
Art. 9 Surveillance file
1 The PTSS shall open a file in the processing system for each surveillance order. 2 The file contains all the documents on the case concerned, namely:
3 The surveillance data shall be stored in accordance with Article 11 SPTA and destroyed in accordance with Article 14 of the Ordinance of 15 November 20176 on the Processing System for the Surveillance of Post and Telecommunications (PSO-PTSS). |
Chapter 3 Telecommunications |
Section 1 General Provisions on Information and Surveillance Activities |
Art. 17 Requests for information
1 Requests for information from the authorities specified in Article 15 SPTA to TSPs, providers of derived communication services and operators of internal telecommunications networks as well as the information returned to the authorities are transmitted in the online request procedure or via the interfaces using the processing system specified in the PSO-PTSS7. 2 If the online request procedure using the processing system is unavailable for technical reasons, requests for information and the information returned to the authorities may be submitted to the PTSS by post or fax. 3 In urgent cases, the authorities may submit requests for information by telephone to the PTSS, and submit the request for information specified in paragraph 1 or 2 subsequently. 4 The request for information must indicate, in addition to the details required for the type of information concerned, the maximum number of data records to be supplied and, if available, the reference numbers and case names. |
Art. 18 Obligations for the supply of information
1 TSPs and providers of derived communication services with more extensive duties to provide information in accordance with Article 22 must be able to provide the information specified in Articles 35–37 and 40–48 as well as in Article 27 in conjunction with Articles 35, 40, 42 and 43 that relates to services that they provide. They may enlist the support of third parties to do so. 2 They shall provide the information specified in Articles 35–37 and 40–42 and in Article 27 in conjunction with Articles 35, 40 and 42 in an automated process via the query interface of the PTSS processing system. They may also provide the information specified in Articles 43–48 and in Article 27 in conjunction with Article 43 manually. 3 TSPs with reduced surveillance duties in accordance with Article 51 may also provide information of all types outside of the processing system in writing. 4 TSPs, with the exception of those with reduced surveillance duties in accordance with Article 51, and the providers of derived communication services with more extensive surveillance duties in accordance with Article 52 must be able to provide the information specified in Articles 38 and 39 that relates to services that they provide via the query interface of the PTSS processing system. They may enlist the support of third parties to do so. 5 Providers of derived communication services without more extensive duties to provide information and conduct surveillance and operators of internal telecommunications networks are not required to provide information of the types specified in Articles 35–48 and in Article 27 in conjunction with Articles 35, 40, 42 and 43. They shall supply the information available to them via the processing system or by a different method in written form. 6 If the number the data records found exceeds the maximum value specified in the request, the provider shall only disclose their number. |
Art. 19 Identification of the participants
1 TSPs, providers of derived communication services with more extensive duties to provide information in accordance with Article 22, providers of derived communication services with more extensive surveillance duties in accordance with Article 52 and retailers in accordance with Article 2 letter f SPTA must ensure that subscribers are identified by suitable means. 2 In the case of professionally operated public WLAN access points, TSPs must ensure that all end users are identified by suitable means. |
Art. 20 Recording personal details in the case of mobile services
1 In the case of mobile services, TSPs and retailers in accordance with Article 2 letter f SPTA must, on supplying the means of access or on the initial activation of the service, verify the identity of the subscriber by means of a passport, an identity card or a foreign national identity card in accordance with Article 71 and 71a of the Ordinance of 24 October 20078 on Admission, Period of Stay and Employment. They must retain an easily legible copy of the identity document. 2 In the case of the natural persons, the following details must be recorded:
3 In the case of legal entities, the following details must be recorded:
4 In the case of customer relationships that are not based on a subscription contract, the following details must also be recorded:
|
Art. 21 Retention periods
1 TSPs and providers of derived communication services with more extensive duties to provide information and conduct surveillance (Art. 22 and 52) must retain and be able to supply the information about the telecommunications services and the information recorded for the purpose of identification for the duration of the customer relationship and for 6 months after its termination. TSPs must retain and be able to supply identification data in accordance with Article 19 paragraph 2 for as long as the right to access the public WLAN access point applies and for 6 months after its expiry. 2 TSPs, with the exception of those with reduced surveillance duties in accordance with Article 51, and providers of derived communication services with more extensive surveillance duties in accordance with Article 52 must retain and be able to supply the following data for the purpose of identification for 6 months:
3 The secondary telecommunications data under paragraph 2 must be destroyed as soon as the retention period has expired, unless other legislation requires or permits such data to be retained for longer. |
Art. 22 Providers of derived communication services with more extensive duties to provide information
1 The PTSS shall declare a provider of derived communication services to be a provider with more extensive duties to provide information (Art. 22 para. 4 SPTA), if it has met one of the following criteria:
2 If a provider controls one or more undertakings required to file financial reports as defined in Article 963 paragraph 2 of the Code of Obligations10, the provider and the controlled undertakings must be regarded as a single unit when calculating the values in accordance with paragraph 1. 3 Providers that exceed or fail to meet the criteria in paragraph 1 letter b must notify the PTSS of this in writing within three months of the end of their financial year and submit related supporting documents. 4 Providers must on request provide the PTSS with the information and supporting documents for assessing the criteria under paragraph 1 letter b. The PTSS may rely on data obtained in implementing the legislation relating to the surveillance of post and telecommunications or by other authorities in implementing federal law. 5 A provider that is declared to have more extensive duties to provide information must ensure that it can store the data required for providing information within 2 months and provide the information within 12 months of the declaration. 10 SR 220 |
Art. 23 Assistance in providing information and conducting surveillance activities
If third parties are engaged by the provider to assist in providing information or conducting surveillance activities, they shall be subject to the same requirements as the provider. The provider remains responsible for providing information and conducting the surveillance activities ordered to the extent specified; in particular it shall take the measures required to ensure that suitable contact persons for providing information and conducting the surveillance activities ordered are available to the PTSS at all times. Both the provider assigned the task by the PTSS and its assistants serve as contact points for the PTSS. |
Art. 24 Standardisation of types of information and surveillance
1 The Federal Justice and Police Department (FDJP) shall standardise the types of information and surveillance that are defined in this Ordinance. 2 If, based on the international standards and the enquiries made of the persons or entities required to cooperate, it proves impossible or unreasonable to standardise a type of information or surveillance, the FDJP shall dispense with doing so. |
Art. 25 Special information and surveillance activities
In the case of information and surveillance activities that do not correspond to a standardised type of information or surveillance, TSPs and providers of derived communication services shall provide the PTSS with all already available interfaces and connections to the PTSS processing system. The content and the secondary telecommunications data of the telecommunication of the person under surveillance must be supplied as far as possible in accordance with Article 26 paragraph 1 SPTA. The PTSS shall determine the modalities in specific cases. |
Art. 26 Types of information in general
1 The providers concerned shall provide the following types of information on telecommunications services or derived communications services:
2 The authorities may only request the information that providers are required to provide in accordance with the procedures defined in this Ordinance. |
Art. 27 Obtaining information with a flexible name search
1 Requests for types of information specified in Articles 35, 40, 42 and 43 may be complied with by carrying out a search that tolerates errors and finds phonetic matches (flexible name search). In this case, the suffix “FLEX” shall be added to the abbreviation for the relevant information request type: IR_5_NA_FLEX, IR_11_TEL_FLEX, IR_14_email _FLEX and IR_16_COM_FLEX. 2 The request for information shall in each case contain the first and at least one additional query criterion for the underlying information request type. |
Art. 28 Types of surveillance
1 The providers concerned must conduct the following types of real-time surveillance for telecommunications services and derived communications services:
2 The providers concerned must conduct the following types of retroactive surveillance activities for telecommunications services and derived communications services:
3 The providers concerned must conduct the following types of missing person searches (Art. 67):
4 The providers concerned must conduct the following types of searches (Art. 68):
|
Section 4 Types of Information Requests for Network Access Services |
Art. 35 Information Request Type IR_4_NA: Information on subscribers to network access services
1 Information Request Type IR_4_NA comprises the following information about subscribers to network access services:
2 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria. If letters a–e are used, a second query criterion must be added. If searching for character strings (lets a, c, d and f), the provider must search only for the specified spelling of the term in accordance with the applicable FDJP regulations:
|
Art. 36 Information Request Type IR_6_NA: Information on network access services
1 Information Request Type IR_6_NA comprises the following information about network access services. For information specified in letters b, c and e, details of the common period of validity shall be provided:
2 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria:
|
Art. 37 Information Request Type IR_7_IP: Identification of the users in the case of uniquely assigned IP addresses
1 Information Request Type IR_7_IP comprises the following information about the identified subscriber if this person was assigned a unique IP address at the time in question:
2 The request for information shall contain the following information:
|
Art. 38 Information Request Type IR_8_IP (NAT): Identification of the users in the case of IP addresses that are not uniquely assigned (NAT)
1 Information Request Type IR_8_IP (NAT) comprises the following information about the identified subscriber if this person was not assigned a unique IP address (NAT) at the time in question:
2 The request for information shall contain information about the NAT translation procedure for the purpose of identification:
|
Art. 39 Information Request Type IR_9_NAT: Information on NAT translation procedures 11
1 Information Request Type IR_9_NAT comprises the following information for the purpose of identification in connection with NAT translation procedures if required for identification:
2 The request for information shall contain the following information about the NAT translation procedure:
11 The correction of 9 April 2019 relates to the French text only (AS 2019 1201). |
Section 5 Types of Information on Applications |
Art. 40 Information Request Type IR_10_TEL: Information on subscribers to telephony and multimedia services
1 Information Request Type IR_10_TEL comprises the following information about subscribers to telephony and multimedia services:
2 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria. If using letters a–d, a second query criterion must be added. If searching for character strings (let. a, c, d and f), the provider must search only for the specified spelling of the term in accordance with the applicable FDJP regulations:
12 The correction of 3 Dec. 2019 relates to the French text only (AS 2019 4085). |
Art. 41 Information Request Type IR_12_TEL: Information on telephony and multimedia services
1 Information Request Type IR_12_TEL comprises the following information about telephony and multimedia services. . For information specified in letters b, c and e, details of the common period of validity shall be provided:
2 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria:
|
Art. 42 Information Request Type IR_13_EMAIL: Information on subscribers to E‑Mail-services
1 Information Request Type IR_13_EMAIL comprises the following information about subscribers to email services:
2 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria. If using letters a–d, a second query criterion must be added. If searching for character strings (let. a, c, d and f), the provider must search only for the specified spelling of the term in accordance with the applicable FDJP regulations:
|
Art. 43 Information Request Type IR_15_COM: Information on subscribers to other telecommunications or derived communications services
1 Information Request Type IR_15_COM comprises the following information about subscribers to other telecommunications or derived communications services (e.g. messaging services, communications services in social networks, cloud and proxy services):
2 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria. If using letters a–d, a second query criterion must be added. If searching for character strings (let. a, c, d and f), the provider must search only for the specified spelling of the term in accordance with the applicable FDJP regulations:
|
Section 6 Further Types of Information |
Art. 44 Information Request Type IR_17_PAY: Information on the method of payment used by subscribers to telecommunications and derived communications services
1 Information Request Type IR_17_PAY comprises the following information about the method of payment used by subscribers to telecommunications and derived communications services:
2 The information specified in with paragraph 1 must be supplied if the provider has it. 3 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria:13
13 The correction of 6 March 2018 relates to the French text only (AS 2018 989). |
Art. 45 Information Request Type IR_18_ID: Copy of official ID
1 Information Request Type IR_18_ID comprises the provision of an electronic copy of the subscriber’s identification document recorded in accordance with Article 20. 2 The request for information shall specify the period and subscriber or service identifier, SIM number (ICCID) or IMSI or, if applicable, device identifier to which it relates. |
Art. 46 Information Request Type IR_19_BILL: Copy of invoice
1 Information Request Type IR_19_BILL comprises the provision of electronic copies of all available billing records pertaining to the subscriber, not including secondary telecommunications data on telecommunications services and derived communications services. 2 The request for information shall specify the period and unique subscriber or service identifier or unique identifier for accounting or billing to which it relates. |
Art. 47 Information Request Type IR_20_CONTRACT: Copy of contract
1 Information Request Type IR_20_CONTRACT comprises the provision of electronic copies of all available contract documents pertaining to the subscriber to telecommunications services and derived communications services. 2 The request for information shall specify the period and subscriber or service identifier, the SIM number (ICCID) or IMSI or, if applicable, the device identifier to which it relates. |
Art. 48 Information Request Type IR_21_TECH: Technical data
1 Information Request Type IR_21_TECH comprises the provision of technical data relating to telecommunications systems and network elements, in particular the location data for mobile radio cells and public WLAN access points. 2 The location data comprise:
3 The request for information shall specify the period to which the request relates. It shall contain at least one of the following query criteria:
|
Section 10 Types of Retroactive Surveillance |
Art. 60 Surveillance Type HD_28_NA: Retroactive surveillance of secondary telecommunications data in the case of network access services
Surveillance Type HD_28_NA includes the retroactive surveillance of secondary telecommunications data of a network access service. The following secondary telecommunications data of the past telecommunication that has been sent or has been received via the network access service under surveillance must be transmitted:
|
Art. 61 Surveillance Type HD_29_TEL: Retroactive surveillance of secondary telecommunications data relating to telephony and multimedia services
Surveillance Type HD_29_TEL comprises the retroactive surveillance of secondary telecommunications data of a telephony and multimedia service and, if applicable, converging services, in particular SMS, MMS and voice mail. The following secondary telecommunications data of the past telecommunications traffic in communications and communication attempts using the services under surveillance must be transmitted:
|
Art. 62 Surveillance Type HD_30_EMAIL: retroactive surveillance of secondary telecommunications data in the case of email services
Surveillance Type HD_30_EMAIL comprises the retroactive surveillance of secondary telecommunications data of an email -service. The following secondary telecommunications data of the past telecommunication sent, processed or received via the service under surveillance must be transmitted:
|
Art. 63 Surveillance Type HD_31_PAGING: Identifying most recent activity on the mobile terminal device of the person under surveillance
Surveillance Type HD_31_PAGING comprises the identification of the most recent activity detected by the mobile telephony provider (network access services, telephony and multimedia services) on the mobile terminal device of the person under surveillance and providing the MSISDN, IMSI, IMEI (if available), the type of mobile communications technology, the frequency band, the unique identifier of the mobile network, the date and time of most recent activity detected, as well as one of the following details required to determine the location:
|
Art. 64 Surveillance Type AS_32_PREP_COV: Network coverage analysis in preparation for an antenna search
1 Surveillance Type AS_32_PREP_COV comprises the network analysis in preparation for an antenna search in accordance with Article 66. It is carried out by the TSPs and serves to identify the mobile radio cells or public WLAN access points that most probably cover the location described by the ordering authority in the form of geographical coordinates or by means of postal address, if applicable taking account of additional information (e.g. time of day, weather, day of the week, location within or outside of a building). 2 The TSPs shall supply the PTSS with a list of cell identifiers (e.g. CGI, ECGI) or the BSSID for the mobile radio cells or public WLAN access points identified. |
Art. 65 Surveillance Type AS_33_PREP_REF: Reference communications or instances of reference network access in preparation for an antenna search
1 Surveillance Type AS_33_PREP_REF comprises the identification of mobile radio cells or public WLAN access points on the basis of reference communications and instances of reference network access in preparation for an antenna search in accordance with Article 66. 2 The ordering authority shall itself arrange for reference communications to be made and the reference network to be accessed at the location concerned and shall send the PTSS a list with the following related details:
3 The PTSS shall instruct the TSPs, on the basis of the secondary telecommunications data relating to previous telecommunications traffic, to identify the mobile radio cells or public WLAN access points used in each case base at the beginning and at the end of the reference communications and instances of reference network access in accordance with paragraph 2 and to provide it with a list of the corresponding cell identifiers (e.g. CGI, ECGI) or BSSID completed in accordance with paragraph 2. |
Art. 66 Surveillance Type AS_34: Antenna search
1 Surveillance Type AS_34 comprises the retroactive surveillance of all communications, communication attempts and instances of network access that have taken place via a specific mobile radio cell or a specific public WLAN access point over a period of up to two hours.14 2 The TSP shall supply the secondary telecommunications data resulting from paragraph 1 relating to previous telecommunications traffic in accordance with Article 60 and 61. 14 The correction of 3 July 2018 relates to the Italian text only (AS 2018 2551). |
Chapter 4 Final Provisions |
Art. 70 Organisational, administrative and technical regulations
The FDJP shall issue the organisational, administrative and technical regulations on conducting surveillance of post and telecommunications. In particular, it shall determine the deadlines within which the relevant data must be supplied. |
Art.71 Implementation
1 The PTSS shall provide electronic forms and interfaces to be used by those concerned. The forms and interfaces shall make it possible in particular for:
2 The PTSS may at the appropriate time replace the electronic forms with online access to the Service’s processing system and introduce an electronic approval process for orders requiring approval. The electronic forms may continue to be used if online access to the processing system is impossible for technical reasons or if the processing system fails. |
Art.73 Amendment of other enactments
The ordinances below are amended as follows: 1. and 2. …16 16 The amendments may be consulted under AS 2018 147. |
Art. 74 Transitional provisions
1 Surveillance activities ordered before this Ordinance comes into force shall continue unchanged. These activities shall be extended or terminated in accordance with the previous law applicable to those types of surveillance. 2 Circuit trials ongoing in accordance with the previous practice when this Ordinance comes into force shall be terminated. 3 TSPs that submit an application to the PTSS for categorisation as a TSP with reduced surveillance duties in accordance with Article 51 within three months of this Ordinance coming into force shall be deemed to be such from the date on which this Ordinance comes into force and for the duration of the procedure. The PTSS may revoke this categorisation for the duration of the procedure if approval of the application is unlikely. Article 51 paragraph 5 does not apply to TSPs previously required to report. 4 Within 3 months of this Ordinance coming into force, TSPs and providers of derived communication services with more extensive duties to provide information in accordance with Article 22 shall modify their systems in order to implement the new requirements on the identification the subscribers (Art. 19) and recording persons’ details in the case of mobile services (Art. 20). 5 Within 6 months of this Ordinance coming into force, TSPs, with the exception of those with reduced surveillance duties in accordance with Article 51, and providers of derived communication services with more extensive surveillance duties in accordance with Article 52 shall modify their systems in order to be able to supply the information specified in Articles 38 and 39. 6 Within 24 months of this Ordinance coming into force:
7 Until the new processing system procured under the telecommunications surveillance17 programme comes into operation:
8 Within 12 months of the new processing system coming into operation, TSPs and providers of derived communication services with more extensive duties to provide information in accordance with Article 22 shall modify their systems in order to supply the information specified in Articles 35–37 and 40–42 and in Article 27 in conjunction with Articles 35, 40 and 42 automatically via the query interface of the processing system (Art. 18 para. 2) and in order to be able to carry out the flexible name search in accordance with Article 27 in conjunction with Articles 35, 40, 42 and 43. |
Annex |
(Art. 2) |