US police want information about my customer

Hello,
if im not an US citizen and i do have server in US. The customer of mine host a website on this server and it appears this customer breaken laws of some US citizen, so police Detective contacted me asking for details about this customer.

Now my customer has rights i protect his personal info. He can sue me if i provide his info.

I want to ask what is my duties and rights in such case, i would say that i would need court order from country of my business (Europe)?

 

Your server and data is in the US meaning you fall under US laws. If the police have contacted you asking for information (just as long as you have this in writing), you should hand over the information they are asking for. So the government thinks he is breaking the countries laws, however are they breaking your rules? Do you have a TOS?

 

These are the TOS used: https://www.namecheap.com/legal.aspx

 

So I can't look through your TOS as I don't know what kind of illegal website/activities your customer is taking part in to see if they are breaking them. However you should investigate and check your TOS. You should also ask the police to issue a DMCA first (if the illegal site is to do with copyright), which will require you to take action on your customers site. Hope this helps

 

Here's a short list of websites a person should not start on a server located on the US soil:

1. False terrorist claims (false threats, false government or political claims that may stir up unrest)
2. Piracy websites
3. Online gambling (where prohibited)
4. Child pornography
5. Plotting violence

More here: http://www.makeuseof.com/tag/did-you-know-5-illegal-website-ideas-for-the-united-states/

If your customer falls under one of those categories, I would suggest you should immediately suspend his/her account and website and provide the US authorities with the information they are requesting.

If your customer does not fall under any of those categories, you should ask the investigator on what ground they are requesting the info. It could be that the whole thing is just one big hoax (some dissatisfied customer is trying to give you hard time).

 

What should i expect from police to identiffy themselves and to claim personal data of someone, i mean some document or.. i mean anybody can pretend to be someone..

 

Realistically speaking, if you are not a US citizen (and I assume you are not), the US authorities cannot really demand anything from you or charge you with anything. Even if they send you a subpoena to reveal any data or information, since you are not a US citizen, you are not obligated to respond to that. However, since your server is located in the US, they can contact your server provider and ask them to shut down your services for federal law violations.

This is what I'd do if I were in your shoes:

1. I'd email/call them back and ask them to exactly explain on what ground they are demanding to reveal your customer's private information

2. I'd ask them to verify their names, phone #'s and physical address in the US

3. I'd ask them to either email or mail an authorized warrant where it is explained on what ground the customer's personal information should be disclosed to them

If they refuse to do any of that, then you're probably dealing with an extortionist who wants to intimidate you into believing you did something wrong and possibly get money from you.

If they ignore your requests, just brush it off like a bad dream and move on.

 

"police Detective" sounds kind of fishy.

Does a city police officer even have jurisdiction to request info like that ? I doubt it.

 

I'm a law graduate but from what I can understand the TOS is from namecheap.com severs ( located within the US ), they need contact the company hosting your domain servers with a court order or written court consent. You are not obligated to furnished private data that may inflict damages to your client. Sounds like an unlawful way to subpoena someone to bring forward under penalty information to the authorities especially overseas. For all you know this can be a fake.

 

I am a Technology & IP Lawyer and this is how I am putting it--
> Any disclosure of a Personal Identifiable Information must be ordered from a Court or Tribunal ( same as premises search, where the police will need search warrant)
> A police officer may request for such disclosure but that does not mean he is seeking such disclosure through correct channel.
> Never ever doubt that there might be exceptions! If the severity is high they will find a way to access the server they will not need your permission to do so.

 

But, would they not also be breaking the law? The police are not above it and surely any good lawyer would get evidence from this chucked out of court (if it came to a case). Regardless of what "intelligence" agencies may (or may not) be doing on their own/foreign soil, the police are a very different matter. They need either 1) a warrant or 2) consent from the owner of the computer/server or other device.

 

Tell the person who contacted you that you are not subject to their jurisdiction, and that if they properly serve notice on your hosting company that you will comply.
At the same time, open a ticket with your hosting company and inform them that you will eagerly comply if they are properly served with legal notice. Include information on the ticket to assist your host in identifying the applicable files on their server so that they don't shut down anything not involved.
If the request from the police seems legitimate tell your customer they need to find another host when the hosting they paid for is up for renewal. You don't need to have to deal with these kind of problems.

 

The government needs legal process—such as a subpoena, court order or search warrant—to force your servers to disclose user information.

There needs to be some legal transparency, a variety of laws allow government agencies to investigate regulatory violations or criminal activity.

No one can't give you legal advice, you may want to consult a lawyer. My personal advise and knowing the legal process, if you get an email purportedly from a Law Enforcement agency that asks for this type of information, don't provide it, the email is probably a scam, contact your namecheap and report it/verify it. There is a legal process ( rigorous process ) for data release, explained on Namecheap.com terms of service and policy, as you provided for requests within the United States and other countries.

Any information you provide without due process in response to the request is limited ( If granted provided to do so ), to what you believe would help prevent your client's data harm, legal demands when appropriate, only provide information within the scope and authority of the request. The privacy and security of the data that users store on the servers can be disclosed with limited certification if it is related to terrorism, they would need to contact Namecheap.com.. again ( let them handle it ), you wouldn't help much if any issues related if this was real serious. So take steps before going out of your way, and producing information that may affect your client without due notice.

 

The rulebook has many exceptions and government agencies always, if not rarely resort to such exceptions. What you say is completely acceptable and very logical and even I have said the same thing, but what I referred to was the fact that if there was a severity, then information will pass down from that level where they can override to access.

 

From my experience , a local lawyer will be able to guide you because your appropriate response might depend on your local laws and situation. It always makes sense to be on the safe side of local law enforcement. Afterall, you are a business.

 

I like this part... Always lights up a dark tunnel for misfits like me in DP.

 

Now I see from another thread that you are a lawyer in India. Maybe in your country it's different, who knows (I know your country's legal system has some roots with the British), but in the USA and UK (and probably other countries where the legal systems share the same roots) collection, and custody, of evidence has very strict rules. Deviation from them can mean the evidence is inadmissible.

There can be exceptions to warrant requirement, nonetheless great care needs to be taken to ensure that the rules regarding exceptions are very closely followed. If it is deemed that unjustifiable, then the evidence can be thrown out.

Look up the Fourth Amendment, but also the Fourteenth Amendment, too.

In the OP's case, he agreed to a TOS which requires him to respond to law enforcement requests such as a subpoena. This is irrespective of location, due to it being a US company. So, to remain in good standing with his host (i.e. for his account to not be terminated), it would be in his interests to respond to any subpoena. In this instance, there isn't one, so raising a ticket with his webhost and directing this so-called "police detective" to their legal department would make most sense. (At least if it turns out to be legitimate, and a subpoena is provided, the OP can be seen as pro-active from the beginning. Or if it's a scammer fishing for information, it ends up being someone else's headache.)

 

A Pure business answer:

A) Google the police department's phone #. Then contact the police department on their main line and confirm the individual is an officer. Then speak to the officer and confirm he sent you the letter. SAY NOTHING ELSE. Just state the purpose of the call was to confirm he did send it + you will respond later.

B) If it is real:
Then provide the police officer with the information you need and suspend the clients account. As a businessman you don't need this trouble.

If it is false:
Then its up to you, but I would suspect the individual's competitor wants him out of business and tried to do this.