Section 35 of the Cybercrime Code Act 2016 opens Division 2 — Preservation of Evidence.
Section 35
Where specified data or a printout is reasonably required for the purposes of an investigation or proceedings, the Court may, on application by a member of the Police Force or the Public Prosecutor, order —
(a) a person in control of an electronic system or device, or thing to produce specified data or a printout of such data; or
(b) an ICT Service Provider to produce information about persons who subscribe to or use its services.
Two different orders
| Paragraph (a) | Paragraph (b) | |
|---|---|---|
| Who | Any person in control of a system, device or thing | An ICT service provider — see Schedule 1 |
| What | Specified data, or a printout of it | Subscriber information — who subscribes to or uses the service |
| Typical use | Business records, message logs, account contents, system logs | Identifying the person behind an account, an IP address or a number |
Most online offences begin with an anonymous account, a username, an IP address or a phone number. Paragraph (b) is how an investigator turns that into a name.
Note that it is not confined to subscribers: the words are “persons who subscribe to or use its services”, which reaches a person using a service without a subscription.
It is limited to information about persons. It does not authorise production of the content of communications — that falls under paragraph (a), or under section 39.
The threshold and the safeguards
The test is that the data or printout is “reasonably required for the purposes of an investigation or proceedings”. There is no requirement of reasonable suspicion that any particular person committed an offence, and no requirement that the offence be one under this Act.
What section 35 does require is a Court order, on application by a member of the Police Force or the Public Prosecutor. Unlike a preservation notice under section 36 — which police may issue themselves — production requires judicial authorisation.
The word “specified” is also a safeguard. An order must identify the data sought; it is not a warrant for everything a provider holds.
How it fits the investigative sequence
- Section 36 — preservation. A written police notice requiring data to be preserved for up to 14 days, extendable once. This stops the data disappearing while an application is prepared.
- Section 35 — production. A court order requiring the preserved data, or subscriber information, to be produced.
- Section 37 — partial disclosure. Where the path of a communication and the providers involved must be identified.
- Section 38 — restraining order. Where material is likely to be removed, destroyed, deleted or tampered with.
- Section 39 — interception. Where future communications must be collected or recorded.
The two-step structure exists because most communications data has a short life. A section 36 notice can be issued immediately, by written notice, without going to court. The court application under section 35 then follows.
If you receive a production order
- Comply within its terms. For an ICT service provider, section 44(1)(d) makes failure to comply with a court order requiring assistance a crime carrying 25 years, or K1,000,000 for a body corporate.
- Check the confidentiality direction. Where the order stipulates confidentiality, section 45 makes it a crime for a provider to disclose the existence of the order, anything done under it, or the data collected — 25 years, or K500,000 for a body corporate.
- Produce what is specified, not more. Producing data beyond the order is a disclosure without lawful excuse, capable of engaging section 25.
- Record what was produced. Chain of custody matters to the admissibility of the material at trial. See electronic evidence.
- Take advice if the order appears defective. An order that does not specify the data, or that is sought for a purpose outside an investigation or proceeding, may be challenged.
For victims, a production order is often what makes an offender identifiable — see what to do if you are a victim.
Sources
- Cybercrime Code Act 2016 — ss 2, 25, 35–39, 43, 44, 45; Schedule 1
- Constitution — s 49
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.