The Swiss Federal Supreme Court confirms that Threema GmbH does not offer telecommunications services with its instant messaging service and Internet telephony. The Court thus restricts the obligation of OTT service providers to cooperate in the monitoring of their users' telecommunications traffic and puts the Swiss Surveillance Service in its place.
What It's All About
Threema GmbH ("Threema") is a Swiss technology company and provider of the end-to-end encrypted instant messaging service of the same name – a Swiss competing solution to WhatsApp.
The Swiss Post and Telecommunications Surveillance Service ("Surveillance Service") treated Threema as a telecommunications service provider ("TSP"). It required Threema to carry out real-time monitoring of metadata, and thus to provide the information necessary to carry out the surveillance and to remove the transport encryption Threema had applied itself. These obligations to cooperate apply to TSP (as defined in art. 2 lit. b of the Swiss Federal Act of 18 March 2016 on the Surveillance of Post and Telecommunications [SPTA] in conjunction with art. 3 lit. b of the Swiss Federal Telecommunications Act of 30 April 1997 [TCA]). Certain providers of derived communication services ("PDCS") – which undisputedly does not include Threema – are also subject to further monitoring obligations (art. 50 para. 1 in conjunction with art. 52 of the Swiss Federal Ordinance of 15 March 2016 on the Surveillance of Post and Telecommunications [SPTO]). See on the obligations to cooperate which apply to the various providers also our article from 2018 "New Surveillance and Information Obligations for Communication Service Providers".
In dispute before the Federal Supreme Court was the qualification of Threema as a TSP made by the Surveillance Service. Surveillance Of Messaging Services: Swiss Surveillance Service Is Put In Its Place
How It Came About
By order dated 13 December 2019, the Surveillance Service qualified Threema as a TSP under the SPTA and required it to provide the aforementioned cooperation (art. 56 SPTO). Threema, which is committed to particularly high data protection requirements and even allows the anonymous use of its service without using a cell phone number, filed an appeal against this order. The Swiss Federal Administrative Court approved the appeal in its judgment A-550/2019 of 19 May 2020, and annulled the order of the Surveillance Service. It held that Threema qualifies as a PDCS (within the meaning of Art. 2 lit. c SPTA), i.e. as a "provider of services which are based on telecommunications services and enable one-way or multi-way communication" and is subject to less far-reaching obligations to cooperate. The Swiss Federal Department of Justice and Police ("FDJP"; which is responsible for the Surveillance Service) filed an appeal against this with the Swiss Federal Supreme Court.
How The Swiss Federal Supreme Court Classifies OTT Services Under Surveillance Law
In its judgment 2C_544/2020 of 29 April 2021, the Swiss Federal Supreme Court, after an illustrative interpretation of the relevant provisions, concludes that Threema with its so-called over-the-top (OTT) services merely qualifies as a PDCS.
For the Swiss Federal Supreme Court, it is decisive that Threema neither offers Internet access nor assumes any responsibility towards its customers for the transfer of information via the Internet (cons. 3.2) – rather, customers would have to "resort to third-party offers for the Internet access required for the transport of information". Threema is thus to be regarded as a classic provider of OTT services, both with regard to its instant messaging service and with regard to Internet telephony.
According to the current SPTA, only those who offer "the sending or receiving of information by wire or radio" are considered to be a TSP (art. 2 lit. b SPTA in conjunction with art. 3 lit. c TCA; cons. 4.2). According to the Swiss Federal Supreme Court, this is precisely what OTT service providers lack. Although Threema would feed signals into the Internet for the benefit of its customers, the mere feeding of information into a line network – and this is the decisive criterion for OTT services – is not to be understood as the transmission of information for third parties (cons. 4.2 [grammatical interpretation]).
Under Swiss telecommunications law, according to the legal materials, the qualification as a telecommunications service is based on "the transport of information by means of telecommunications technology". Under Swiss surveillance law, the decisive factor for the term "telecommunications service" is whether information itself is transported or transmitted (cons. 5.1.1 [historical interpretation]). In contrast, according to the SPTA Dispatch of 27 February 2013 (German version), a PDCS provides services which can only be offered in connection with the activities of a TSP (in particular Internet access provider; cons. 5.1.1).
According to the Swiss Federal Supreme Court, the relatively recent SPTA (2016) as well as the debate that already took place during the legislative process and the foreseeable technical circumstances also speak against the treatment of OTT services as telecommunications services advocated by the FDJP (cons. 5.2.2). Regarding comparable services, there was already no close relationship between the network and the (communications) service at that time, "which is why it is not possible to speak of an unforeseeable abolition of a previously mandatory close link between the network and the (communications) service as a result of technological development or of a significant change in the actual circumstances compared to the actual circumstances assumed by the legislator". Furthermore, there had been no change in customer needs that would speak for a different interpretation result (cons. 5.2.3 [objective-contemporary interpretation]). Thus, the attempt by the Surveillance Service and the FDJP to retroactively expand the conceptual understanding of "telecommunications service" under the SPTA fails.
The Swiss Federal Supreme Court further emphasizes that the Swiss Federal Council may subject PDCS to the strict cooperation obligations of TSP under certain conditions (art. 22 para. 4 and art. 27 para. 3 SPTA). Also, the Surveillance Service could exempt TSP from certain obligations to cooperate upon request (art. 26 para. 6 SPTA in conjunction with art. 51 SPTO). In this respect, there is, in Swiss Federal Supreme Court's view, already a flexible approach to the graduated obligations to cooperate under surveillance law which is appropriate to the individual case (cons. 5.4 [teleological and systematic interpretation]).
The FDJP was also unable to rely on the Swiss Federal Office of Communications' (OFCOM) Guide to the Notification Form for the Provision of Telecommunications Services of 1 May 2010 (German version; which has been superseded by the TCA revision), which notoriously seeks to expand the conceptual understanding of telecommunications services. The Swiss Federal Supreme Court clarifies that this is an administrative regulation which is not binding on the Swiss Federal Supreme Court and cannot justify a deviation from the legally relevant definition of telecommunications service (cons. 5.5.1). The FDJP also failed in its attempt to derive something in favour of its position from the TCA revision with statements on the expanded term "telecommunications service", since the future SPTA will no longer be linked to the definition of telecommunications service in the TCA (cf. art. 2 para. 1 lit. b and para. 2 revised SPTA, German version).
What This Means For (Other) Providers Of OTT Services
The Swiss Federal Supreme Court's judgment is convincing. If it had turned out differently, this would have had an explosive effect beyond Threema:
First, providers of OTT services would have been subject to obligations to cooperate, which would have meant real-time monitoring and the removal of transport encryption. In fact, the distinction between "TSP" and "PDCS" would have become obsolete in the context of telecommunications surveillance (as also stated by the Swiss Federal Supreme Court in cons. 4.2).
Second, the protection of user privacy would have become a mere empty phrase. And precisely this protection is one of the most important selling points of providers like Threema today. Certainly, there may be scenarios in which it is justified to impose stricter obligations to cooperate on corresponding providers. However, art. 22 para. 4 and art. 27 para. 3 SPTA already provide a suitable means for this.
- Transparency Report Threema 2021;
- Dispatch of the Swiss Federal Council of 27 February 2013 on the SPTA (German);
- Dispatch of the Swiss Federal Council of 6 September 2017 on the TCA revision (German);
- Leaflet of the Surveillance Service on the demarcation TSP and PDCS of 26 July 2018;
- (new) OFCOM guide on registration as TSP of 18 March 2021.