The Yahoo! case – enforcing a domestic production order (Article 18.1.b Budapest Convention) against a foreign-based service provider offering services in the territory
2007–2015
The Yahoo! case is a landmark line of Belgian jurisprudence that illustrates how a domestic production order can lawfully be addressed to, and enforced against, a foreign-based electronic service provider whose services are offered in the territory of the requesting Party – the very mechanism codified in Article 18.1.b of the Convention on Cybercrime (Budapest Convention) and later formally elaborated by the Cybercrime Convention Committee (T-CY) in T-CY Guidance Note #10 of 1 March 2017.
On 3 October 2007, the local police of Aalst (Belgium) opened a criminal investigation against unknown perpetrators for online fraud, computer fraud and forgery in electronic form (Articles 496, 504quater and 210bis of the Belgian Criminal Code – articles 7 and 8 of the Budapest Convention). The perpetrators had made use of a number of "@yahoo.com" e-mail accounts. On 21 November 2007, the Public Prosecutor of the District of Dendermonde (Belgium) issued a written production order under Article 46bis of the Belgian Code of Criminal Procedure to Yahoo! Inc. (textual in line with article 18.1.b of the Budapest Convention), headquartered in Sunnyvale, California, requesting the subscriber and registration data associated with those accounts (IP address at account creation, timestamp, linked recovery e-mail, and any other data enabling identification of the user).
Yahoo! Inc. refused to comply, arguing that the data related to U.S.-registered accounts, that they fell exclusively within the scope of the U.S. Electronic Communications Privacy Act (ECPA), and that Belgian authorities had to route their request through mutual legal assistance via the U.S. Department of Justice. After successive reminders between November 2007 and July 2008 went unanswered, the Public Prosecutor indicted and prosecuted Yahoo! Inc. for failure to comply with the statutory duty to cooperate.
The case then travelled the full length of the Belgian court system, generating seven successive decisions over seven years:
- Correctional Court of Dendermonde, 2 March 2009 – conviction
- Court of Appeal of Ghent, 30 June 2010 – acquittal
- Court of Cassation, 18 January 2011 – cassation of the acquittal
- Court of Appeal of Brussels, 12 October 2011 – acquittal
- Court of Cassation, 4 September 2012 – cassation
- Court of Appeal of Antwerp, 20 November 2013 – conviction
- Court of Cassation, 1 December 2015 – final rejection of Yahoo! Inc.'s appeal; the conviction became definitive.
Through this litigation the Belgian courts progressively confirmed two principles that, taken together, form the operational backbone of Article 18.1.b of the Budapest Convention:
- Personal scope – "offering a service in the territory". The duty to co-operate applies to every operator of an electronic communications network and to every provider of an electronic communications service that offers its services on Belgian territory, irrespective of nationality, place of incorporation or the existence of any physical establishment in Belgium. A provider that offers its services (webmail, OTT communications, e-mail) virtually to end-users on Belgian territory falls within the scope of the obligation.
- Territorial character of the measure – no extraterritorial exercise of jurisdiction. In its final judgment of 1 December 2015, the Court of Cassation held that a production order for subscriber information is a domestic measure of limited scope: it seeks only identification data, requires no presence of Belgian officials or agents abroad, requires no material act to be performed on foreign territory, and is completed on Belgian territory once the requested data are received, pointing out that the requested basic subscriber information is bringable (in the hands of the requesting prosecutor) and not gettable. The offence of non-co–operation is therefore committed in Belgium. Compelling compliance through Belgian criminal enforcement does not amount to any extraterritorial exercise of jurisdiction, nor to any infringement of the sovereignty of another State. Mutual legal assistance is not required.
A remarkable feature of this case is its timing. When the Belgian prosecution of Yahoo! Inc. was launched in 2007–2008, Belgium had not yet ratified the Budapest Convention. Ratification only followed on 20 August 2012, with entry into force on 1 December 2012 – in the middle of the litigation. Yet the Belgian courts, and in particular the Court of Cassation, consistently reasoned along the very principles that underpin Article 18.1.b of the Convention: territorial reach based on the offering of services, domestic enforceability of production orders against foreign-established providers, and the clear distinction between a production order (as an exercise of domestic jurisdiction) and coercive measures on the territory of another State (which would require mutual legal assistance).
The Yahoo! case thus stands as an early and paradigmatic illustration – indeed a schoolbook example – of the interpretation the T-CY would formally endorse later in Guidance Note #10 on Production orders for subscriber information (Article 18 Budapest Convention), adopted on 1 March 2017 following the 16th Plenary. That Guidance Note confirms, in line with the Belgian jurisprudence, that a production order addressed to a service provider offering its services in the territory of a Party is a domestic order that may be issued and enforced under domestic law, even where the provider is not physically established in that territory and even where the data may be stored in another jurisdiction or "somewhere in the cloud".
The Yahoo! case is a striking demonstration of how universal, forward-looking and time-proof the concepts and principles of the Budapest Convention were designed to be: they proved capable of guiding a domestic jurisdiction even before formal accession, and they continue to structure the enforcement of production orders in the age of cloud-based, OTT and cross-border digital services.
Relevant Budapest Convention provisions and guidance
- Article 18.1.b – Production order addressed to a service provider offering its services in the territory of the Party, for the submission of subscriber information in the service provider's possession or control
- Article 15 – Conditions and safeguards
- T-CY Guidance Note #10 (1 March 2017) – Production orders for subscriber information (Article 18 Budapest Convention)
Extensive use of spontaneous information sharing (Article 26 Budapest Convention) – the "electronic evidence tennis" practice
Ongoing practice
Belgium has developed a particularly broad, active and pragmatic use of Article 26 of the Budapest Convention (spontaneous information) as one of its preferred and most frequently used mechanisms for the cross-border sharing of electronic evidence. In the daily work of the Belgian prosecution services, spontaneous information sharing under Article 26 has become a routine – and, indeed, a first-line – instrument for exchanging electronic evidence with partner jurisdictions, not only in cybercrime cases in the narrow sense, but in every criminal investigation in which electronic evidence is relevant.
A deliberately informal mechanism
The Belgian practice is characterised by a deliberately light and informal procedure. In principle, a simple e-mail from the competent Belgian judicial authority to its foreign counterpart, with the information attached (typically as a PDF or as structured digital evidence), is sufficient. Depending on the sensitivity and confidentiality of the data concerned, however, encrypted and appropriately secured communication channels – such as SIENA, dedicated law-enforcement or judicial secure e-mail systems, or other end-to-end encrypted transmission tools – are self-evidently considered and used instead of ordinary e-mail. In all cases, the transmission expressly refers to Article 26 of the Budapest Convention as the legal basis of the disclosure and, where necessary, sets out the conditions under which the information is shared.
Typical conditions imposed by Belgian authorities include:
- no onward transfer of the information to a third country without prior consultation with, and consent of, the Belgian authorities;
- no operational action (arrests, searches, technical measures, public communication) on the basis of the shared information without prior coordination;
- use of the information as evidence in criminal proceedings only to the extent consistent with the domestic law of the receiving Party;
- a duty to report back on the use of the information and on any follow-up investigative developments.
Subject to those conditions and to the domestic law of the receiving Party, the shared information may be used directly as evidence in criminal proceedings – without the need for a subsequent mutual legal assistance request, European Investigation Order or other formal channel – because Article 26 itself constitutes the international legal basis for the lawful transmission and the admissibility of the evidence.
"Electronic evidence tennis" – coordinated mirror investigations
Belgium regularly complements Article 26 by opening, in agreement with the foreign counterpart, parallel or "mirror" investigations in the jurisdictions concerned. Once those coordinated national investigations are running, evidence and information obtained on one side are shared spontaneously across the border and integrated into the national investigation of the other Party. The evidence remains foreign in origin, but it has been lawfully obtained by the providing Party under its own domestic law and it is lawfully and admissibly received by the other Party on the basis of an international legal ground (Article 26 of the Convention on Cybercrime), read in conjunction with the admissibility rules of the receiving Party and the conditions attached by the providing Party. No further international judicial-co–operation instrument is required to underpin its transmission.
Belgian practitioners refer to this working method as "electronic evidence tennis": two or more countries take the field with their respective national (mirror) investigations and choose to exchange evidence spontaneously "across the net" – cleanly and efficiently – rather than routing every element of proof through the often slow and formalistic channels of international mutual legal assistance. The rally continues throughout the investigation, back and forth, until a national case is built that stands on its own feet.
The added value is significant: (i) the pace of the investigation is set by operational needs rather than by MLA timelines; (ii) the evidence – foreign in origin – enters the receiving national investigation with a solid international-law basis for its lawful transmission and admissibility, sparing the parties the delays and formalities of an MLA request or European Investigation Order; (iii) coordination between the parallel investigations prevents duplication and reduces the risk of unintended operational conflicts; and (iv) confidentiality and operational security are protected by the conditions attached to each transmission.
Two well-known lines of investigation (amongst many others) illustrate the operational value of the Belgian approach:
- The judicial investigations that followed the terrorist attacks in Brussels of 22 March 2016 relied amongst others on Article 26-based exchanges of electronic evidence with partner jurisdictions, enabling a fast-moving, transnational investigation to progress without becoming hostage to formal MLA timelines.
- In the SKY ECC investigation – one of the largest law-enforcement operations against an encrypted-communications platform used by organised crime – Article 26 of the Budapest Convention served as one of the principal legal bases for the coordinated sharing of the intercepted communications and their derivatives between the in the investigation involved countries, and also feeding national investigations across Europe and beyond.
A first-line instrument, not a second-best channel
Contrary to the sometimes-heard perception of spontaneous information sharing as an "informal" or subsidiary channel, the Belgian experience demonstrates that Article 26 of the Budapest Convention is one of the most powerful, versatile and cost-effective tools available for cross-border criminal-justice co-operation in the digital age. As confirmed by T-CY Guidance Note #14 of 25 June 2025, spontaneously shared information may – subject to conditions imposed by the providing Party and to the domestic law of the receiving Party – be used as evidence in criminal proceedings in the receiving Party without further formality. The Belgian practice fully embraces that reading and turns Article 26 into a genuine first-line instrument for judicial co-operation in an age of ubiquitous electronic evidence.
Relevant Budapest Convention provisions and guidance
- Article 26 – Spontaneous information
- Article 15 – Conditions and safeguards
- T-CY Guidance Note #14 (25 June 2025) – Spontaneous information (Article 26 Convention on Cybercrime)