Remote searches and jurisdiction on the Internet

Are Dutch law enforcement officers allowed to log into the Gmail-account of a suspect and check their e-mail for evidence gathering purposes?

This question has captivated me for the last 1,5 years. In 2011 I argued that hacking is not a legitimate investigatory method in the Netherlands. That might change soon, because the Dutch Minister of Safety and Justice plans to propose a bill which makes that possible (see also my earlier blog post on cross-border remote searches). However, interesting questions remain in relation to international criminal law and remote searches.

Old discussion

After the extensive study of Dutch parliamentary documents in relation to the investigatory method of a “network search”, I concluded in a new article (.pdf in Dutch) I wrote together with Charlotte Conings of the KU Leuven, that online investigatory methods can only be used on “computers in Dutch territories”. The exception to this rule is when officers are (a) “in good faith” that the computer resides on Dutch territory, (b) they have permission from another state to execute their investigatory methods on a computer in their territory, or (c) they operate on the basis of a treaty. Based on literature, most legal scholars affirm the general rule that secretly gathering evidence from computers in the territory of another state is in violation of international law.

Renewed discussion

The problem is that the “computer orientated jurisdiction rule” described above is hard to work with in practice. Especially due to cloud computing techniques, by way of which fragmented data can reside on many different servers in different countries, making it is increasingly hard to pinpoint the location of data on a server. Some suggest that because of this “loss of location” of data, law enforcement authorities are increasingly left in the dark as to which state “controls the data” and which state to ask for permission. As a consequence, they resort to gathering evidence remotely – via the Internet – under their own national procedural rules. The influence of cloud computing and criminal investigations is described in this interesting WODC-report (.pdf in Dutch. English summary available here) released two weeks ago.

In my opinion, it is quite clear in many cases which jurisdiction and thus which procedural rules apply to the majority of electronic communication services that make use of cloud computing. The reason for this is that many popular “cloud services” are US electronic communication service providers. As described in their law enforcement guideline, Google for example provides user data under specific conditions based on US law. With regard to data requests from “foreign law enforcement authorities” they explain that: “On a voluntary basis, we may provide user data in response to valid legal process from non-U.S. government agencies, if those requests are consistent with international norms, U.S. law, Google’s policies and the law of the requesting country.” I wonder how they deal with inconsistencies between the different norms prescribed by law..

The actual problem is that law enforcement authorities would much rather access the accounts directly, under their own rules, rather than waiting for Google to reply and having the uncertainty of whether they will actually provide the data.

Towards new jurisdictional rules?

In our new article, Charlotte and I analyzed the interesting “pragmatic approach” of Belgium towards online jurisdictional issues and investigatory methods. Under specific conditions, they will allow a remote search of connected computers, such as servers from webmail and online payment services, even if those servers are possibly situated in a different territory. We believe this pragmatic approach is interesting and maybe even desirable under certain conditions, as long as the investigatory methods are used on citizens and persons in the states own territory. If we would allow remote searches of the personal online accounts of foreigners, states would impose their own national rules on foreign nationals which in turn would create legal uncertainty for people about which procedural rules apply. Based on the reciprocity principle, states could do the same in our territory. This pragmatic approach is not ideal and does not solve the problem that the company who possesses the data may simply regard the unauthorized access of foreign authorities as a crime and treat it as such. In an ideal world, states would agree with one another under which conditions data can be gathered remotely over the Internet, but I doubt if that’s possible. The debate about online (enforcement) jurisdiction is far from over.

This is a cross post from LeidenLawBlog.nl.

Some thoughts on the EU cybersecurity directive

Last week the European Commission presented a proposal for a directive (.pdf) on cybersecurity. The directive aims to improve network and information security by requiring Member States to implement a national cybersecurity strategy, a cybersecurity cooperation plan, a competent national authority on cybersecurity and a Computer Emergency Response Team (CERT). The directive also seeks to expand security breach notifications for IT incidents in relation to critical infrastructures and to create a infrastructure for confidential information sharing.

The directive raises some interesting questions about how cybersecurity is best dealt with.

Personally I am convinced cybercrime and cyberespionage incidents are rising exponentially, making it necessary for states to take action. A Washington Post article from a few days ago about Chinese espionage is illustrative of this fact. Our IT systems are often not protected adequately and we are rightfully concerned about the IT protection of critical infrastructures.

In its quest to improve cybersecurity, the Commission envisions a critical role for national cybersecurity centres. The promotion of public private partnerships, mandatory security breach notifications for critical infrastructures (which is defined quite broadly, see art. 3(8)(b)), secretive information sharing (see art. 9) and powers for cybersecurity centres to compel  security audits and information from “market operators and public administrations to provide information needed to assess the security of their networks and information systems” (art. 15), are all examples of measures proposed in the directive. Other than the proposed enforcement powers for cyber security centres, not much would change for the cybersecurity policy of the Netherlands. The directive proposes many measures that are already carried out or proposed in our own cybersecurity strategy, such as the security breach notification for critical infrastructures, governmental involvement in major cybersecurity incidents and the vigorous promotion of public private partnerships and information sharing.

The idea is that when cross-border incidents arise, cyber security centres notify other centres about the “cyber threat” to prevent more damage and possibly take coordinated action. By sharing information in public private partnerships the overall level of cybersecurity is improved and the relevant parties can respond to the incident in a coordinated manner. Because much of the IT infrastructure and important data is in private hands, cooperation from private companies is required. However, not all companies may wish to share private data, including client data, with cyber security centres and thereby automatically involve law enforcement authorities and security services. Because of the proposed establishment of a central authority for network and information security some even fear the “militarization of cyberspace”.  From a more cynical perspective, one may fear a bureaucratic toothless institution with conflicting powers and tasks overlapping those of other agencies. We could also consider other measures. For example, I support the plea (in Dutch) of Bart Schermer to actually provide the instruments to our privacy watchdog to enforce the requirement of “sufficient technological and organizational measures” to adequately protect personal data.

No panacea for cybersecurity

I believe we should be careful to place cybercrime-, cyberespionage-, cyberterrorism-, and cyberwarfare issues all under the umbrella term of “cybersecurity”. Issues relating to these different fields (of law) need attention on their own merits and may require different actions from our legislator. We should realize that cyber security centres and information sharing is no panacea for cybersecurity.