Extraterritoriality and digital surveillance – time for the lawyers and the advocates to bring the dialogue together

This weekend, as an ex-bureaucrat, I felt for the folk at the State Department.  It must have been a ridiculously busy weekend for those preparing for this week’s Human Rights Committee Hearing in Geneva.  On Friday, the New York Times leaked Harold Koh’s legal advice acknowledging that the US obligations under the International Covenant on Civil and Political Rights do not stop at the border.  The NYT article would have meant that the briefing folders that had been merrily making their way up the clearance chain in time to be packed into the delegation’s suitcases would have been discarded (or at least the sections on extraterritoriality would have been yanked out) and all the talking points would have needed to be rewritten.

This is not just an important moment for bureaucrats or international human rights law junkies; it is potentially powerful for digital rights activists pushing for reform of global surveillance practices.  Digital rights advocates have been calling for the US government to end global mass suspicionless surveillance and to adhere to their international human rights law obligations.  There may be a strong moral case to support them, but when it comes to the NSA’s overseas activities, the discourse has often lacked a strong legal underpinning.  In order to push governmental policy on this issue, the dialogue needs to mature to the point where it is built on solid legal underpinnings.  The next couple of months bring an unprecedented opportunity to do just that. Continue reading Extraterritoriality and digital surveillance – time for the lawyers and the advocates to bring the dialogue together

Advertisements

Whistleblowing about government surveillance: political offense or serious crime?

[cross-posted from http://cyberlaw.stanford.edu/blog]

It seems like the world has been turned upside down when a US citizen flees to China seeking political asylum.  And yet Edward Snowden is apparently hiding out in a secret location in Hong Kong after revealing that he is responsible for the leaked information on the US government’s PRISM program of surveillance.  He explains his choice of refuge as being based on Hong Kong’s reputation for defending freedom of speech.  He is also apparently considering Iceland as another potential refuge.  But if the US chooses to prosecute him, will he be able to avoid being sent home to face charges?  A key part of the answer lies in whether his leaking of official secrets qualifies as a ‘political offense’.

Continue reading Whistleblowing about government surveillance: political offense or serious crime?

One heck of a timely UN report on government surveillance of communications

If it had happened on House of Cards, you’d have enjoyed the theater of it, but figured that the writers had taken some artistic license in the timing.  I mean, it just doesn’t happen in real life that the UN releases a report on the dangers of government surveillance on the internet immediately before the news breaks that the US Government has been conducting internet surveillance of previously unimagined proportions.  Critics could unkindly say this is because the UN is never ahead of the game, but in this case, you have to hand it to Frank La Rue – he has clearly authored an exceptionally timely report: Continue reading One heck of a timely UN report on government surveillance of communications

Trust us, we’re the Government – sharing evidence internationally

It’s the nature of academic articles that by the time they’re published you’ve almost forgotten that you wrote them, particularly if the journal is an annual.  It is therefore pleasantly surprising that as my article on ‘Sharing Evidence Across Borders:  the human rights challenge’ is published ((2012) 30 Aust YBIL 161), I find that the topic is still very much current and the questions raised are still relevant, possibly even more so than when I wrote it a couple of years ago.

Being able to transfer evidence between countries is essential for cross-border investigations and prosecutions.  Even aside from crime types that are obviously transnational in nature such as drug trafficking or international money laundering, everyday crimes are easily given a ‘transnational’ aspect if the criminals use international email providers, have a foreign bank account or if a key witness lives in another country.  Clearly, public policy dictates that investigations and prosecutions can’t be allowed to stop at the border.  To fill this gap Mutual Legal Assistance Treaties (MLATs), law enforcement cooperation and letters rogatory have developed.  However, transferring evidence into another jurisdiction can have significant human rights implications.

After authorities in one country hand evidence over to another country, they may lose control and visibility of how that evidence is used.  And yet, instinctively, it seems like a country should not be able to wash its hands of all responsibility after handing over evidence.  When legal cooperation is used to move people rather than evidence (ie extradition), there are very clear human rights protections.  An abolitionist country cannot extradite or deport a person to a country if there is a real risk that he or she may be subject to the death penalty.  Similar obligations arise if a country wishes to extradite a person to a country where there is a real risk of a person being subject to torture or to cruel, inhuman or degrading treatment or punishment.  However, there is no such obligation if one country provides evidence to another country and that country then uses the information to impose the death penalty, torture or other cruel, inhuman or degrading treatment or punishment on an individual.

Many see this as unjust and there is a temptation to extend the international law that applies to extradition to MLATs and law enforcement cooperation.  After all, the consequences for individuals can be just as dire when countries share evidence as when they cooperate for extradition.  However, if you carefully analyse the extradition jurisprudence and try to apply it to evidence-sharing, you encounter a number of significant logical and legal problems.

In order to be practical and politically-palatable, there must be limits on a country’s human rights obligations.  International human rights law obligations are therefore generally limited to persons within that country’s jurisdiction.  When evidence is provided to foreign countries, it usually affects individuals in the foreign country.  It is difficult to find a logical way to argue that those individuals are within the ‘jurisdiction’ of the country providing evidence.  There are a couple of unique situations in which international human rights law has been found to apply to individuals extraterritorially.  These include where an individual is under that country’s effective control (eg prisons operated in Iraq by allied forces) or for particular rights such as the issuing of a passport or the enforcement of a judgment in absentia.  When you analyse these extraterritorial situations, they seem to be fundamentally different from a person about whom a foreign country facilitates providing evidence.

I therefore argue that international human rights law does not create any obligations with respect to law enforcement cooperation or mutual legal assistance.  This is not to say that there should not be legal obligations, just that they do not currently exist under international human rights law.  Any attempt to create obligations needs to engage with the complexity of the issue, not just assume that the same rules that apply to extradition can be applied to evidence-sharing.

The treaties that create evidence-sharing relationships provide some protections by specifying situations in which the requested country may refuse to provide evidence.  Such situations include where the death penalty would be imposed or there is a real risk of torture.  However, this is permissive rather than mandatory.  Moreover, MLATs and agreements on law enforcement cooperation are negotiated on an ad hoc basis and there is no uniformity in approach.  In the end, it all comes down to the particular policies of the administration that negotiated the treaty and the policies in place at the time that it is asked to provide the evidence.

The government makes decisions about which countries it is appropriate to enter into evidence-sharing relationships with and on what terms.  There is also scope to make decisions about specific requests.  For example, the requested country may specify that evidence will only be provided if the other country gives certain assurances (eg not to impose the death penalty).  Enforcement of such undertakings is a diplomatic matter.  In this way, the responsibility to make the right decisions about who to do business with and on what terms is largely a matter for the executive.

The system is further complicated when third parties hold the requested evidence, and these parties have their own relationship with the owner of the information.  The most pressing current example is online records.  Companies such as Google and Facebook hold large amounts of user data and many of their users reside in foreign jurisdictions.  The relationship of trust between these companies and their users is a valuable part of their business.  Being a good corporate citizen and cooperating with law enforcement to combat crime may also be important, but the priorities are not necessarily always compatible.

This somewhat changes the assumption that evidence-sharing can be handled adequately on a purely diplomatic basis because you have an additional party with a different set of interests.  This is not a new problem; for many years, countries have been sharing bank and telephone records.  However, the scale of the issue has certainly grown, with users storing more and more personal data online and increasing numbers of these users being in different jurisdictions from the tech companies.

These companies can scrutinize the requests that flow through from the Department of Justice or law enforcement to ensure that the legal requirements have been met.  However, where the discretion is a matter for the executive, the companies have limited options.  It is for the government to decide whether the other country’s justice system is adequate or undertakings are sufficient.  Provided that the other legal requirements are met, the company is obliged to hand over their user’s information.  Essentially, the system is based on trust that governments will do the right thing.

The increasing role of third party holders of information brings another dimension to the question of civil liberties protections in international evidence sharing.  It means that there is a new voice in the debate.  While governments have tended to keep evidence sharing confidential, tech companies are increasingly going public about government requests for user data.  Companies may challenge government requests in the courts on behalf of their users and raise public awareness about any perceived deficiencies in the laws.  What has tended to be an obscure area of government practice where the lack of legal protections has gone largely unnoticed now has the potential to become an issue of public discussion and concern.

Julian Assange – epic failure of the international human rights system?

Over the coming weeks and months, international lawyers and commentators will no doubt be falling over themselves to write about the issues raised by Julian Assange’s stalled extradition process and dramatic receipt of diplomatic asylum.  Who could blame us when this case raises so many unusual and complex issues of international law and politics? What interests me most is the fact that the Government of Ecuador has effectively declared its distrust of the human rights protections offered by the extradition and criminal justice processes of three countries.  Not just any countries, mind you; Sweden, the United Kingdom and the United States.  While no country’s justice system is perfect, these three countries arguably have some of the world’s most advanced legal systems for extradition and human rights protection and yet we have seen Ecuador invoke the laws of diplomatic asylum to protect Assange where these systems have allegedly fallen short. Continue reading Julian Assange – epic failure of the international human rights system?

What is the greatest risk to online rights – government, companies or anarchy?

Nick Merrill is building an internet service provider called Calyx. Calyx will be designed to encrypt user’s data in such a way that it’ll be inaccessible to anyone but that user. Which means that if the government asks for your browser history or emails, Calyx will be technologically unable to hand them over.’.

When I stumbled across this, I was horrified.  As a civil servant and government lawyer, I bridled at the blatant attempt to undermine the criminal justice process.  But then I read on and watched videos of Nick Merrill telling his story of fighting a national security letter requiring him to disclose details about one of the clients of his ISP company.  It is quite compelling to hear of his 6 year battle for recognition of his entitlement to speak with his attorney and his right to tell others that he was issued with a national security letter.  So Nick Merrell’s encrypted ISP project started to sound less like paranoia and more like a rational reaction.

Just this week, I read that at the recent Black Hat Conference, when the room full of internet and security professionals was asked who they trusted less, Google or the government, the majority raised their hands for Google.  This surprised me, given the deeply ingrained distrust of big government and led me to wonder whether we were sliding into a situation in which the public will not trust anyone with regulation of online activities.  Is the web to become a wild west of anarchy because we are too afraid to trust anyone with any form of monitoring or enforcement? Continue reading What is the greatest risk to online rights – government, companies or anarchy?

Going beyond the guidelines – legal and moral responsibilities on ICT companies

YouTube this week introduced a face-blurring tool to protect activists from being recognised by their online activities.  Human rights groups will no doubt welcome the initiative as it comes in response to calls from groups such as Witness.  Some web companies demonstrate a commitment to not only reducing the negative human rights impacts of their activities, but also to actively improving the positive impacts that they may have.  The uptake of some of the voluntary guidelines on corporate social responsibility and human rights demonstrates a willingness to go beyond the minimum requirements.  But what responsibilities do tech companies really owe to users in other countries?  Is this solely a question of moral responsibility and ethics, or is there a legal obligation?  And should moral responsibility be reflected in a legally-binding regime? Continue reading Going beyond the guidelines – legal and moral responsibilities on ICT companies