Advertisement
Advertisement
Crime
Get more with myNEWS
A personalised news feed of stories that matter to you
Learn more
Servers in a factory. Photo: Reuters

US, Europe spar over sharing electronic evidence in investigations

  • With the rise of cloud computing, potential evidence to help solve crimes is often stored far from the jurisdictions of law enforcers
Crime

In August 2016, the bodies of a young French man and woman were discovered on a beach in Madagascar, with murder suspected.

The secret to the case could be in the last messages they sent, but those are stored in databanks of US tech giants that do not have to turn over the information to French investigators.

Silhouette of someone using a laptop. Image: Reuters

The case highlights how key evidence needed to solve crimes could sit in computers a continent away under completely different legal jurisdiction.

Washington and Brussels have both proposed solutions to facilitate relatively easy cross-border access to the data for law enforcement officials.

But the issue has stirred up a hornet’s nest of opposition over privacy rules and legal procedures.

Rights groups fear the solutions will lower the barriers to access private data, allowing abuse by governments who could use their access powers against political opponents or activists.

The young French man and woman, volunteers for a local whale protection group, used Facebook’s Messenger and via emails on Microsoft’s Outlook.

Knowing their final messages and movements could be “decisive” in settling the investigation, according to sources familiar with the case.

But given the rise of cloud computing, such evidence is often stored far from the jurisdiction of investigating police.

Getting to it is hampered by old, bulky agreements on international legal cooperation and evidence sharing written before the internet and social media.

This doesn’t work, the operations are totally blocked
European justice official

The problem has been growing for several years.

In 2013 US authorities got a search warrant in a narcotics case to get user information held by Microsoft.

But even though it is a US company, Microsoft fought back in court, saying the data was on servers in Ireland, out of the reach of US investigators.

In the European Union, 85 per cent of criminal investigations involve electronic evidence, of which two-thirds is stored in another country.

Getting potential evidence from a Facebook account takes Europeans on average 10 months.

A European investigating judge must ask an official of his government to send an official request to the US government.

A US judge, who isn’t familiar with the case, then makes the request to Facebook.

Next the FBI reviews the evidence to ensure it does not contain confidential information unrelated to the original request.

The data is then sent to the requesting government which passes it to the investigators.

“This doesn’t work, the operations are totally blocked,” a frustrated European justice official said.

“Virtually every serious threat we investigate today requires access to electronic evidence like the contents of emails, instant messages, photos, traffic data, session logs, subscriber information, and the like,” Richard Downing, a top US Justice Department official, said in a speech in London last month. “Our collective safety and security depends on our ability to maintain lawful and efficient cross-border access to that evidence.”

Seeking a longer-term solution, in March 2018 the US passed the Cloud Act, which sets up the possibility of easier cross-border cooperation in obtaining communications and other digitally-stored evidence needed in investigations.

The act would allow foreign governments to request the information – emails, text messages, and stored records – directly from US-based communications and internet.

The act would require bilateral agreements that give Washington reciprocal rights to obtaining electronic evidence.

But many Europeans are suspicious of Washington’s bilateral approach, rather than dealing with the European Union as a whole.

Pedestrians using mobile phones in London. Photo: AFP

Some believe the US would use the Cloud Act to collect information on European citizens and not just Americans.

“No one can accept that a foreign government, even American, could come and with no warning look for data on our societies stored here by American companies, without us able to respond,” said French Finance Minister Bruno Le Maire.

However – as the French investigation shows – Europe recognises the need for new rules.

The European Commission has proposed its own solution – “e-evidence” – for easing cross-border requests for electronic evidence.

As with the Cloud Act, it bypasses existing structures for evidence sharing: authorities would make requests directly to the service providers, regardless of where the data is kept.

The service providers would have 10 days maximum to respond.

Both systems have raised concerns about too few protections against abuse.

The European proposal has not been greeted unanimously by EU members. Germany and the Netherlands have expressed reservations about the e-evidence proposal because of a lack of privacy protections.

This article appeared in the South China Morning Post print edition as: row over digital evidence sharing
Post