The globalization of criminal evidence has altered the landscape for criminal investigations worldwide. With the advent of electronic communication and the rise of the popularity of social media, a crime that physically takes place within the borders of one country often has electronic evidence that is located outside the borders of that country. A recent report for the European Commission stated, “More than half of all investigations [in Europe] include a cross-border request to access e-evidence.”1
A simple example may help explain. A burglary takes place in Paris with the victim and the alleged perpetrator located in France. The suspected thief sends an email to a collaborator prior to the crime to plan the heist and posts pictures of the stolen loot on social media after the theft. Both the email and the social media post are likely stored outside of Europe, often in the United States, which requires a U.S. judicial warrant for production of the content of communications. This means collection of this evidence by French police would have to involve international cooperation.
Much work is currently underway to modernize the main approaches used for cross-order transfers of evidence,2 including mutual legal assistance treaties (MLATs),3 the Budapest Convention,4 and possible executive agreements under the U.S. Cloud Act.5 Even with these efforts, a concern remains that the updated mechanisms may not address the need to scale to smaller countries or countries that have typically made fewer mutual legal assistance (MLA) requests. This article focuses on the challenges facing these countries, notably to have a dependable system of authentication so that the recipients of the requests can be assured that the requests are legitimate. We suggest two mechanisms for enabling requests by these countries, using Interpol, or building on the correspondent bank model used in the global financial system.
The Challenges Facing Smaller Countries or Countries who have Typically made Fewer MLA Requests
Although the example above illustrates the issue using a crime committed in a European country, this problem exists for law enforcement in every country. When attempting to update existing mechanisms for the international transfer of electronic evidence, one hitherto-little-addressed challenge is how to enable access for smaller countries and countries that have typically made fewer MLA requests.
One approach is to have a bilateral agreement between the two countries involved. In the example above, the bilateral agreement would be between France and the U.S. This approach, however, would lead to an immense number of bilateral agreements. Currently, the United Nations has 193 countries who are members.6 Thinking of bilateral agreements among the roughly 200 countries in world, the number of agreements necessary for each country to have an agreement with every other country would be 200 factorial – a huge number that calculates to 78 followed by 373 zeroes.7
A more limited approach might be for the roughly 200 countries to prioritize agreements with countries holding the most electronic evidence, such as the U.S., EU Member States, and India. That would still require a significant number of bilateral agreements. Even in the slimmed down approach, these bilateral agreements would still take a lot of time and energy to negotiate.
One concern we highlight is that intermediate-sized countries might not get priority treatment in order to negotiate agreements. Think, for instance, of intermediate-sized countries such as Chile in South America (population 18 million), Cameroon in Africa (23 million), or Cambodia in Asia (16 million). The problems would likely be even more acute for smaller countries, such as Suriname in South America (560,000), São Tomé and Principé in Africa (200,000), or Bhutan in Asia (730,000). Yet, for the police forces in such countries, as they investigate serious crimes, the crucial evidence may exist only in electronic form, stored in a distant country. Smaller countries are not necessarily the highest priority for the largest nations, but crimes in these smaller countries are undoubtedly serious to the local populace.
Two Possible Ways to Authenticate and Provide Greater Access to Smaller Countries
For smaller countries to seek evidence held in other countries, a crucial initial issue is how to authenticate the request. An online service provider may not have any established way to ensure that the request is truly from an authorized law enforcement official in Peru, Suriname, or another country. Mechanisms must be in place to authenticate that the law enforcement agency making the request is, in fact, law enforcement and not a “bad actor” inappropriately attempting to get sensitive information.
Then, assuming authentication is established, additional issues often arise about whether the requesting country has met due process standards for turning over the evidence. Global service providers have built up relatively extensive experience with large countries that make many cross-border evidence requests, such as Brazil and India. For smaller countries, or countries that do not often make requests, the service provider may have no similar basis for determining whether due process standards have been satisfied.
To address authentication, and possibly also due process standards, we offer two suggestions: 1) INTERPOL model; and 2) correspondent banking model.
1) INTERPOL Model
The first suggested approach would be to use a well-known international group, such as INTERPOL, to authenticate those law enforcement agencies requesting electronic evidence from another country.9 INTERPOL currently has 194 member countries.10 INTERPOL’s mission is to seek to facilitate law enforcement information exchange by providing secure communication channels connecting all member countries.11
Each member country in INTERPOL has a body serving as the National Central Bureau (NCB), which coordinates with other law enforcement agencies in the country, with INTERPOL’s General Secretariat, and with the NCBs in other countries.12
A country’s participation in INTERPOL could enable a two-part electronic authentication for the law enforcement agencies within member countries. Each of the NCBs has a working relationship with INTERPOL that allows their identities to be authenticated by INTERPOL. Each NCB, in turn, should be able to authenticate the law enforcement agencies within its own country.13
To address authentication issues via electronic means, one idea would be to have INTERPOL provide authenticated email addresses to law enforcement agencies within member countries. INTERPOL could provide an email address (such as @ INTERPOL.org) to each NCB to distribute to authenticated law enforcement agencies within its country. The email address would let the receiving country know that the law enforcement agency had been authenticated by the NCB, which in turn has been authenticated by INTERPOL.
In addition, it might be possible for INTERPOL to provide a platform for electronic transmission of the law enforcement requests and for the responses from the receiving countries. With the assistance of an international organization – such as INTERPOL – and perhaps rule changes within INTERPOL, this model has the possibility to scale to many countries around the world.
2) Correspondent Banking Model
A second approach to addressing the authentication problem would be the correspondent banking model long used for long-distance financial transactions. Traditionally in correspondent banking, a small number of large banks have had direct access to a central bank and to each other. Smaller banks come to those large banks to interact with the international banking system.14 An example would be the settlement of a payment from bank A to bank D via a correspondent bank. Often, smaller banks A and D do not hold accounts or have any direct relationship with each other. To make a payment, Bank A would use its correspondence relationship with a large bank, Bank B. Bank B would use its existing relationship with another large bank, Bank C. Bank C would be the correspondent bank for Bank D, completing the payment.15
Correspondent banking is especially important for cross-border transactions. In this system, large banks around the world have relationships with other large banks in various countries. For smaller banks, the larger bank provides transactional services to the smaller bank. In classical correspondent banking, a smaller bank (known as a respondent bank) enters into an agreement with the larger bank (called the correspondent bank) to execute payments on behalf of the smaller bank and its customers. The smaller bank’s customers do not have direct access to the larger bank’s account, but the customers are able to transact business indirectly.16
Applying the correspondent banking model to cross-border transfers of electronic evidence, a smaller country, or a country who has typically made fewer requests, would use a regional platform to ensure the transmission of authenticated requests. The regional platform would enter into a bilateral agreement with the smaller country. The relationship would allow the regional platform to authenticate requests from the requesting country. The regional platform would authenticate the identity of one point of contact or multiple points of contact (POCs) within the requesting country. Requests would thus go from the requesting country (similar to the respondent bank) to the regional platform (similar to the correspondent bank). The regional platform (correspondent bank) would then provide the request to the receiving country (if it is a “correspondent bank”) or to a different regional platform (if the request is being sent to a smaller country).
Examples should help illustrate the point. For Cameroon, the African Union might act as the authenticating organization. Another variation would be for the requesting country to contract with a larger country to run the system – such as South Africa. In South America, Brazil or Argentina might set up direct criminal evidence relationships with the U.S. and Europe. Smaller countries such as Suriname could have bilateral agreements with one of these countries, and then Brazil and Argentina would authenticate the requests from the smaller countries.
This approach would allow the initial review of the law enforcement request to occur by the requesting country according to the requesting country’s laws. In the proposed approach, the initial review would relate only to authentication of the party requesting the evidence – the country or organization acting as the intermediary would not do a review of content of the request.
It is possible, in addition, that the entity doing the authentication would play a role beyond authentication, such as to assess whether due process standards have been met in the requesting country. A regional platform, such as the African Union, might develop expertise in the procedures of the requesting countries in its region, and then be in a position to certify or otherwise provide information to those receiving the request for evidence. In the global banking system, for instance, there are “know your customer” and other rules that govern whether a correspondent bank will complete a particular transaction with a respondent bank. We note this possibility, while suggesting that initial efforts focus on effective authentication for requests, in order to get the system functioning before making it too complex.
The correspondent banking model has the possibility to scale to many countries. Correspondent banking shows how a system can spread throughout the whole world. If you get a moderate number of larger countries or regional organizations in the system, then that moderate number can connect to the rest of the world. The proposed system for global scalability for electronic evidence across 200 countries can learn from another system that needed to apply globally, the banking system.
Conclusion
We have suggested two approaches – the INTERPOL model and the correspondent banking model – that have the potential to address the authentication problem for smaller countries, or those countries that do not often make cross-border requests for criminal evidence. Within INTERPOL or the correspondent banking approach, there would be technical measures to provide high-quality authentication. These approaches provide smaller countries with a more effective ability to investigate serious crimes in their jurisdictions, in our new era when relevant evidence is often held abroad. Such an approach would not only assist in providing justice for local crimes and trans-national threats such as terrorism. By enabling more countries to participate in the system, it could also reduce the incentive that requesting countries otherwise have to require data localization, so that local police can investigate crimes. In short, pursuing a more scalable global model would meet important goals of both smaller and larger nations in the new era of globalized evidence.
1 Commission Staff Working Document Impact Assessment Accompanying the Document ‘Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters’ and ‘Proposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings,’” European Commission (Brussels 17.4.2018), p. 14-15, https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=SWD:2018:0118:FIN:EN:PDF.
2 For an overview of these global efforts, see the article by Théodore Christakis, Jennifer Daskal, and Peter Swire entitled “The Globalization of Criminal Evidence,” IAPP, Oct. 16, 2018, https://iapp.org/news/a/the-globalization-of-criminal-evidence/.
3 For background on MLA, view the section on MLA in the publication by Madhulika Srikumar, Sreenidhi Srinivasan, DeBrae Kennedy-Mayo, and Peter Swire entitled “India-U.S. Data Sharing for Law Enforcement: Blueprint for Reforms,” ORF. Jan. 17, 2019, p. 38-40, https://www.orfonline.org/wp-content/uploads/2019/01/MLAT-Book-_v8_web-1.pdf. For an overview of reform efforts for MLA, review the article by Ian Brown, Vivek Krishnamurthy, and Peter Swire, “Reforming Mutual Legal Assistance Needs Engagement Beyond the U.S.,” Lawfare, March 1, 2016, https://www.lawfareblog.com/reforming-mutual-legal-assistance-needs-engagement-beyond-us.
4 For updates on the proposed protocol regarding enhanced international cooperation on cybercrime and electronic evidence to the Convention of Cybercrime of the Council of Europe (“Budapest Convention”), view Council of Europe’s T-CY Drafting Group, https://www.coe.int/en/web/cybercrime/t-cy-drafting-group.
5 See Peter Swire & Jennifer Daskal, “Frequently Asked Questions About the U.S. Cloud Act,” Cross-Border Data Forum, Apr. 16, 2019, https://www.crossborderdataforum.org/frequently-asked-questions-about-the-u-s-cloud-act/.
6 Overview, About the UN, United Nations, https://www.un.org/en/sections/about-un/overview/.
7 200 Factorial – 200!, CoolConversion.com, https://coolconversion.com/math/factorial/_200_factorial%3F.
8 Population estimates are from Wikipedia.
9 For background on this concept, view the article by Gail Kent entitled “Sharing Investigation Specific Data with Law Enforcement – An International Approach,” Stanford Public Law Working Paper, Fulbright Police Research Scholar, Feb, 14, 2014, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2472413.
10 Member Countries, Who Are We, INTERPOL, https://www.interpol.int/Member-countries/World.
11 Strategy, Who Are We, INTERPOL, https://www.interpol.int/Who-we-are/Strategy/.
12 Each country participating with INTERPOL has a national-level law enforcement agency serving as an NCB. See INTERPOL Constitution, Articles 25 & 32, https://www.interpol.int/en/Who-we-are/Legal-framework/Legal-documents.
13 For background information on utilizing points of contact (POCs) within country, read the article by Peter Swire and Deven Desai entitled “A ‘Qualified SPOC’ Approach for India and Mutual Legal Assistance,” Lawfare, March 2, 2017, https://www.lawfareblog.com/qualified-spoc-approach-india-and-mutual-legal-assistance.
14 For background, view C.A.E. Goodhart, “The Changing Role of Central Banks,” London School of Economics, https://www.bis.org/events/conf100624/goodhartpaper.pdf. For a more detailed analysis of central banks, see C.A.E. Goodhart’s book entitled, “The Central Bank and the Financial System,” Palgrave Macmillan (1995), https://www.palgrave.com/gp/book/9780333626610.
15 Committee on Payments and Market Infrastructures, “Correspondent Banking,” Bank for International Settlements, July 2016, p. 9, https://www.bis.org/cpmi/publ/d147.pdf.
16 Committee on Payments and Market Infrastructures, “Correspondent Banking,” Bank for International Settlements, July 2016, p. 10, https://www.bis.org/cpmi/publ/d147.pdf.
This blog is written in collaboration with the work of the Internet & Jurisdiction Policy Network. The I&J Policy Network will hold its 3rd Global Conference in Berlin, Germany, from June 3-5, 2019. For more information, visit https://conference.internetjurisdiction.net/.
The authors of this blog work with the Cross-Border Requests for Data Project at Georgia Tech, https://www.iisp.gatech.edu/cross-border-data-project; and the Cross-Border Data Forum, https://www.crossborderdataforum.org.
These statements are attributable only to the authors, and their publication here does not necessarily reflect the view of the Cross-Border Data Forum or any participating individuals or organizations.