Section 37 of the Cybercrime Code Act 2016 exists because a single communication rarely travels through a single provider.
Section 37
Where the Court is satisfied, on application by a member of the Police Force or the Public Prosecutor, that specified data stored in an electronic system or device, or thing is required for the purpose of an investigation or proceeding, the Court may order such person to disclose sufficient traffic data about a specified communication to identify —
(a) the ICT Service Providers involved; and
(b) the path through which the communication was transmitted.
Why the power is needed
An email or a message sent in Papua New Guinea may pass through a mobile network, a domestic internet provider, an international transit carrier, a submarine cable operator, a content delivery network and a platform’s own infrastructure — several of them outside the country.
An investigator holding one end of the communication may have no way of knowing which of those entities to approach with a production order or a preservation notice.
Section 37 solves that. It compels disclosure of enough traffic data to map the route and name the participants — so that the substantive orders can then be directed to the right entities, and, where they are offshore, so that international co-operation under Part VI can be sought.
Why the order is “partial”
The order is for “sufficient traffic data … to identify” the providers and the path. Two consequences follow:
It is not a content order. Traffic data is data about a communication — its origin, destination, route, time, duration, size — not what it said. Content is obtained under section 35(a), or prospectively under section 39.
It is not a general traffic data order. The word “sufficient” caps the disclosure at what is needed for the two identified purposes. Traffic data revealing more — a person’s wider pattern of communication, their contacts, their location history — is outside the order. For a broader collection of traffic data there is section 40.
That is the sense in which disclosure is partial, and it is the section’s principal safeguard.
Sections 35, 37 and 40 compared
| s 35 production | s 37 partial disclosure | s 40 traffic data | |
|---|---|---|---|
| What is obtained | Specified data or a printout; or subscriber information | Sufficient traffic data to identify providers and path | Traffic data associated with a specified communication |
| Time frame | Existing data | Existing data | During a specified period — prospective |
| Who is ordered | A person in control; or a provider | Such person as the Court orders | A person in control of the data |
| Threshold | Reasonably required | Required for the purpose — Court satisfied | Reasonably required — Court satisfied on sworn evidence |
Sections 39, 40 and 41 all require the Court to be satisfied “upon sworn evidence”. Sections 35, 37 and 38 do not use that phrase.
The distinction tracks the intrusiveness of the power. Interception, ongoing traffic collection and remote forensic tools reach into future and private communications; production, partial disclosure and restraint deal with material that already exists.
“Traffic data”
Section 2 defines traffic data. In substance it is the information generated by a communication system about a communication — the route, the origin and destination, the time and the duration — as distinct from the content.
The same term governs section 40, and the distinction between traffic data and content runs through Part IV.
If you receive a partial disclosure order
- Read the two limbs. Disclose what identifies the providers and the path — not more.
- Do not disclose content. Section 37 does not authorise it, and doing so without lawful excuse may engage section 25.
- Check for a confidentiality direction. Where one is present, section 45 makes disclosure of the order’s existence a crime for a provider — 25 years, or K500,000 for a body corporate.
- Comply. For a provider, section 44(1)(d) makes failure to comply with a court order a crime carrying 25 years.
- Record what was disclosed. It matters to the chain of custody — see electronic evidence.
Sources
- Cybercrime Code Act 2016 — ss 2, 25, 35–41, 44, 45, 46, 47
- Constitution — s 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.