New Danish law can lead to substantial internet censorship

On 12 January 2017, the Danish Ministry of Justice presented a draft law on website blocking for public consultation. This step had been expected for a couple of months as part of the government’s action plan on countering online extremism and radicalisation. Denmark has a complete opt-out from the Justice and Home Affairs (JHA) area of the European Union, so the new EU Directive on Combating Terrorism, which also includes an optional provision for website blocking, does not apply to Denmark.

Despite the official focus on online extremism and radicalisation, the draft law takes a very broad view on website blocking. The proposed new section in the Administration of Justice Act provides that a website can be blocked if there is reason to assume that a violation of the Danish penal code takes place on the website. Any violation of the penal code, including a new very broad anti-harassment provision for public employees in Section 119a which goes considerably beyond insult and defamation, can be grounds for blocking.

According to the comments of the draft law, the “reason to assume” criterion is to be understood in the same way as the criterion for seizing items from a third party that is not a suspect in a criminal case in sections 803-804 of the Administration of Justice Act. The Danish State Prosecutor for Serious Economic and International Crime (SØIK) has used Section 804 to seize a large number of .dk domain names based on rather broad reasons involving intellectual property rights (IPR) infringement. To illustrate this, a 2016 press release from the prosecutor states that SØIK has seized 423 domains which were suspected of defrauding Danish consumers.

The decision to block a website will always require a prior court order, but the “reason to assume” criterion and the related case law for seizing domains names based on Section 804 of the Administration of Justice Act suggest that the legal requirements to block a website will be fairly low. Moreover, the court decision will be made in proceedings at a lower court where only the police participates. There is no opposing party in the court case and no appeal option if a website is blocked. The owner of the website will only be informed of the decision to block after the court ruling has been made. This is similar to the current procedure for seizing domain names which appears to have been the inspiration for the new blocking provision.

There is no requirement that the police first considers less intrusive options than blocking an entire website, such as takedown of the allegedly illegal material through mutual legal assistance procedures with authorities in the country hosting the website. The preference for blocking would certainly be consistent with the Danish police’s practices against online child pornography. In 2010, the German NGO AK Zensur published a study of the Danish blocking list for child pornography as the secret list had been leaked. In just 30 minutes, AK Zensur was able to take down websites with child pornography which had been on the blocking list for two years by simply contacting the hosting providers for the websites.

The draft law is very lacking in terms of fundamental rights safeguards. There is a rather vague proportionality condition which says that a website cannot be blocked if the blocking is disproportionate in relation to the importance of the case and the disadvantage that the blocking would cause. The only guidance given to the courts in interpreting this is that a social media website cannot be blocked if only a single user profile contains material that violates the Danish penal code. In addition to being vague, it is totally unclear how this proportionality assessment will be made in practice since only the police appears before the court. As decisions to block will be made by lower courts in Denmark with no appeal option (unless the police request is denied), it is very unlikely that consistent legal criteria for blocking will be applied.

The comments of the draft law mention (almost in passing) that website blocking is an interference with freedom of speech, but apart from that there is no consideration of the implications for fundamental rights. Neither Article 10 of the European Convention of Human Rights (ECHR) nor Article 11 of the Charter of Fundamental Rights of the European Union are referenced. The latter is relevant because the EU Net Neutrality Regulation 2015/2120 requires that national laws on website blocking comply with the Charter. Irrespective of what is mentioned in the comments of the law, Danish courts are, of course, bound by the ECHR. However, since only the police is part of the court proceedings, the lower court with limited resources would presumably have to analyse the contents of the entire website on its own accord and consider the relevant case law from the European Court of Human Rights (which the Ministry of Justice has apparently not considered) in order to assess whether blocking would comply with the requirements of Article 10(2) of the ECHR. This seems rather unlikely to happen.

In summary, the Danish Ministry of Justice has presented a draft law with very broad powers to block websites, with very limited legal safeguards against disproportionate blocking, and with a court oversight that is likely to be more formal than real. The blocking provision could lead to substantial internet censorship in Denmark. Interestingly, the Ministry of Justice says itself that the new provision could potentially apply to a large number of websites, and that the police would have to weigh the resources needed to obtain a blocking order against the seriousness of the violation. It is almost as if budgetary limitations of the police will constitute the main safeguard against massive blocking of websites.

The blocking will be implemented at the Domain Name System (DNS) level. The Internet Service Providers (ISPs) are required to assist the police by falsifying the DNS queries for the blocked websites in their own DNS servers and setting up landing pages to inform the end-users that the website has been blocked by a court order. The fact that the blocking is to be done at the DNS level is perhaps the only comforting element of the draft law since DNS blocking is trivial to circumvent by the internet users. The Ministry of Justice is aware of the circumvention possibility but believes, nonetheless, that access to illegal material will be reduced for the average internet user. Persons actively seeking radicalised content online are unlikely to be “average” internet users, though.

You can also read this article in German at https://netzpolitik.org/2017/daenemark-neues-gesetz-koennte-zu-erheblicher-internetzensur-fuehren/.

EDRi-gram: Ex parte domain name seizures in Denmark (08.10.2014)
https://edri.org/ex-parte-domain-name-seizures-denmark/

State prosecutor seizes 423 fraudulent websites (only in Danish, 23.02.2016)
http://www.anklagemyndigheden.dk/nyheder/Sider/statsadvokat-beslaglaegger-423-falske-hjemmesider.aspx

Access Blocking means looking away instead of acting, AK Zensur (30.09.2010)
http://ak-zensur.de/2010/09/looking-away.html

Filtering, blocking and take-down of illegal content on the Internet, Council of Europe (20.12.2015) http://www.coe.int/en/web/freedom-expression/study-filtering-blocking-and-take-down-of-illegal-content-on-the-internet

IT-Pol analysis of the draft law to block websites (only in Danish, 18.01.2017)
https://itpol.dk/analyser/internetcensur-lovforslag-jan2017

(Contribution by Jesper Lund, EDRi member IT-Pol, Denmark)