Section III HIPCAR – Cybercrime/e-Crimes person otherwise using an Internet service. As subscriber information will only be available if a service is offered, the obligation to produce such data is limited to the Internet Service Provider. The provision is not limited to subscriber Information that is stored electronically but also covers non-electronic records as well. Section 23: Expedited Preservation Computer data that is necessary to identify an offender or prove that a crime has been committed can easily be deleted of modified before investigators are able to secure the evidence. The modification or deletion does not necessarily happen with the intention to shield the offender (for example, traffic data that is relevant for the identification is often deleted automatically within a rather short period of time after the end of a communication as it is not required anymore). Unlike other international approaches (such as the EU Data Retention Directive) the drafters decided not to prescribe the implementation of data retention obligations but to establish a process that enables law enforcement agencies to order the preservation of such data when necessary. Based on an order given pursuant to Section 23 any person so ordered (apart from the suspect) is obliged to preserve the data that was processed during the operation of the service. Section 23 does not include an obligation on the person in control of the data to transmit the relevant data to the competent authorities. The transmission obligation is regulated in Sections 22 and 24. After receiving the order the controller of such information is not allowed to permit the manual nor the automatic deletion of data specified in the order for a period of seven (7) days. The drafters agreed that this period is sufficient to obtain an order to request the transmission of the relevant data. If the order for expedited preservation is not in due time followed by either an order for extension of the period, nor by a production order, the controller of the data may delete the stored information. In order to ensure that investigators have an efficient process to prevent the deletion of relevant evidence and taking into account that Section 23 only prevents the deletion of information and does not give law enforcement access to such information the drafters decided not to require a order by a magistrate or judge, but the section enables any police officer to order the expedited preservation. In the view of the fact that the production order (Section 22) requires an order emanating from the competent authority authorized to do so, ensures the rights of the suspect of the investigation are adequately protected. The period of preservation can be extended one (1) time. Such extension shall be by order of a magistrate or judge. Section 24: Partial Disclosure Albeit the drafters in principle agreed to a strict distinction between the authorisation to order the preservation of data (that can be given by any police officer) and the order to transmit the data (that requires an order from a magistrate or judge) they underscored the necessity of ensuring that investigators are able to obtain immediate access to certain traffic data. Without such partial disclosure, investigators would, in some cases, not be able to trace back the offender and preserve more relevant data when more than one provider was involved. Unlike the production order this instrument is limited to traffic data. Section 25: Collection of Traffic Data The drafters recognised that traffic data plays an important role in Cybercrime investigation. Monitoring the traffic data generated during the use of Internet services enables investigators to identify the IPaddress of an offender and can then attempt to determine his physical location. Section 25 contains two > Model Policy Guidelines & Legislative Text 43