VPNs with servers in Bosnia and Herzegovina

The order may also be made against a person suspected of passing information to or from the perpetrator, or whose telecommunication device the perpetrator uses (para. 3). Operators must enable the measures (para. 4). The article orders handing over information the operator has and fixes no retention period. Whether it reaches a VPN operator is not established.

The Criminal Code of Bosnia and Herzegovina, as amended by a decision of the High Representative of 22 July 2021, also penalises publicly condoning, denying or trivialising genocide, war crimes and crimes against humanity (art. 145a).

Article 145a(2) of the state Criminal Code punishes whoever publicly incites violence or hatred against a group or a member of a group with imprisonment of three months to three years, where the conduct is not the more serious offence of paragraph 1.

Information about who used a telecommunication service can be obtained from the operator under article 72a.

Under the Law on the Intelligence and Security Agency, monitoring communications needs prior authorisation from the President of the Court of Bosnia and Herzegovina or a designated judge (art. 77). In Decision U-21/16 of 1 June 2017 the Constitutional Court held article 78(3)–(5) incompatible with the Constitution and article 8 of the European Convention, because the discretion over extending orders was not clearly prescribed.

A Joint Commission of both houses of the Parliamentary Assembly supervises the agency (art. 18), and a person who was monitored must be informed afterwards unless that would endanger the agency’s tasks (art. 77). The order of the rows is the security score, and a server’s location is not a recommendation.