APPLYING THE PROHIBITION ON EXTRATERRITORIAL ENFORCEMENT TO ELECTRONIC EVIDENCE

The foregoing section was a fairly conventional account of the international law of jurisdiction but was necessary to underpin the discussion here — in no small part because it is important to understand that the rules that exist evolved during times when investigation and prosecution of crimes occurred in the physical (or, as some prefer it, “kinetic”) world. The remainder of this article is about the uneasy interaction between these rules, the presence and nature of digitized information, and shifting state interests and abilities in criminal investigation.

As communication technologies have come to play a more and more ubiquitous role in crime, as in life, there has been a corresponding increase in the preoccupation with how law enforcement can effectively and efficiently gather electronic data for use as evidence. ^{Footnote 35} Due to the form it takes and how it exists within the international communications infrastructure, electronic evidence has a naturally “transnational” nature, and it is increasingly clear that traditional, territorially bound jurisdictional norms such as those described above obstruct investigation more than was even the case with traditional, kinetic evidence. Yet, the early prediction of cyberspace as some kind of “separate place” that could have its own independent legal regime died on the vine. As will be seen, states do treat the Internet and the overall international communications infrastructure as a territorially bounded place, and technology continues to develop in such a way that allows them to do so. ^{Footnote 36} The goal of this section is to review the international law norms regarding enforcement jurisdiction as they apply to cross-border electronic evidence gathering, and it could properly be quite short, as study after study over the last decade or more have indicated that states view cross-border intrusion by law enforcement authorities as a breach of sovereignty and a violation of the bar on extraterritorial enforcement jurisdiction. ^{Footnote 37} Unpacking this picture provides a more nuanced, but still firm, view on this point.

Electronic evidence, in the form of digitized material, presents enforcement challenges for a number of reasons, but most importantly because it is ephemeral and subject to easy movement and manipulation by computers. Accordingly, the question of enforcement jurisdiction regarding electronic evidence very quickly becomes one about “jurisdiction over the Internet” since Internet-based access to the data is really the heart of the matter. If a police officer seizes a computer, a server, a compact disc, or a thumb drive full of data in a foreign state and then drives across the border to her own state, that is essentially the same kind of enforcement jurisdiction as an unlawful search and seizure in traditional terms and can be understood and dealt with in the same way. However, if a police officer who is in a foreign state causes data to be electronically compelled and sent across borders or, more pressingly, if police officers operating computers in their own state obtain data that is stored in a foreign state, the problem becomes more complex. Data can be transient and fast moving; its actual geographical location can be uncertain; and real-time monitoring and gathering may be needed or even required to successfully take an investigative step. The data may be openly obtainable by a website fully accessible to anyone via the Internet, it may be protected by law but not security measures, or it may be secured and require electronic intrusion of some sort (“hacking”) to obtain. Whatever the territorial or geographical aspects of a particular matter, the Internet — and its use by criminals — is the locus of the problem.

Perhaps the single greatest dashed hope regarding the Internet was that it would prove to be a place sui generis, apart from the kinetic world, free from regulation by state laws ^{Footnote 38} or, alternatively, that it would function as some sort of res communis space, subject to cooperative and collective regulation under international law. ^{Footnote 39} None of these Latin hopes ever took shape. From reasonably early times, states could and did treat the Internet as a territorially bounded place. ^{Footnote 40} Jurisdiction was asserted and assumed over as broad a range of state interests as could be imagined, from crime to private law torts, to commerce, to speech, to culture. ^{Footnote 41} As Bert-Jaap Koops and Susan Brenner comment in the preface to their edited collection of studies on jurisdiction over cybercrime, “territoriality still turns out to be a prime factor; apparently, cyberspace is not considered so a-territorial after all.” ^{Footnote 42}

To be sure, the Internet has caused notable and significant stresses and stretching effects upon the jurisdictional rules. As Teresa Scassa and I explored in an earlier article, ^{Footnote 43} the assertion of prescriptive jurisdiction by states over Internet-based activities has led to a rise in the use of the “qualified territoriality” or “extended territoriality” principle — the assertion of jurisdiction based on the impact of a matter upon the territory of a state, even if the whole matter was not contained within that state’s territory. ^{Footnote 44} This principle has proven useful in allowing states and regulatory authorities to deal with the fact that Internet-based matters do not correspond easily to Westphalian concepts. As Justice Gerard La Forest famously said regarding crimes, they may occur “both here and there.” ^{Footnote 45} Yet this is a simple stretching of the territorial principle to deal with the practical realities that globalization has wrought and one that fits well (if slightly fuzzily at its margins) within the traditional law of jurisdiction.

State practice regarding enforcement jurisdiction has also remained more conservative in regard to electronic evidence and generally reflects a territorial understanding of how the law will treat the gathering of data by law enforcement — a view buttressed in no small part by the fact that technological developments increasingly make it possible to tell where data is present or stored. ^{Footnote 46} A recent piece on cybercrime sums up the prevailing attitude of states:

This statement captures the findings of numerous studies that have been done on the subject in the last fifteen years. Indeed, expressions by states of the dual concern of maintaining state sovereignty over territory while coming up with an effective approach to deal with the problem can be tracked back to the 1980s. ^{Footnote 48} The case most frequently cited to prove the point is that of Gorshkov/Ivanov, ^{Footnote 49} two Russian cybercriminals who hacked numerous websites and stole large amounts of information, including credit card numbers. The two were lured to California by the Federal Bureau of Investigation (FBI) under the guise of a job interview at a technology company, and during the “interview,” FBI agents monitored Gorshkov’s access to his computer back in Russia. Obtaining his login and password information, the agents accessed his computer and downloaded its entire contents in order to collect evidence with which to prosecute. Russia protested this action as a violation of its territorial sovereignty and charged the FBI agents with hacking, the Russian Federal Security Service explicitly invoking territorial sovereignty as part of its overall objection. ^{Footnote 50}

This same view was quite evident in the negotiations leading to the Council of Europe’s Convention on Cybercrime, concluded in 2001. ^{Footnote 51} It was clear that potential states parties to the treaty were keenly aware that the inherently cross-border nature of data meant that territorial borders were essentially getting in the way of effective investigation, but the official Explanatory Report also reflects that a territorial understanding of enforcement jurisdiction was still the dominant point of view and that consensus on solutions was difficult to achieve. ^{Footnote 52} The only compromise reached was embodied in Article 32 of the convention, which permitted cross-border access to data by law enforcement authorities in either of two situations: (1) the data is “publicly available (open source)” and, thus, obtainable by anyone on the Internet or (2) the investigating state obtains the lawful and voluntary consent of a person who is legally entitled to disclose the data. Even this fairly mild compromise was controversial, as Slovakia has stated that notwithstanding the article it considers that its domestic courts must still approve any request for data, ^{Footnote 53} while Russia highlighted the article as part of its reasons for not ratifying the convention. ^{Footnote 54}

These examples illustrate that states are sensitive and conservative about any cross-border electronic traffic by foreign investigators and that they wish to maintain the ability to object publicly to actual events or even potential intrusion. There are understandable policy reasons for this. The integrity of territorial sovereignty and control is always key in any discussion of inter-state interaction, and, as noted above, the criminal law is where states are at their most guarded. More specifically, a state may have dual criminality concerns and be leery of the potential for being unwittingly implicated in a prosecution of conduct that it does not view as criminal. It may wish to retain the capacity to refuse to cooperate or allow its territory to be used for enforcement activity where it would view the foreign prosecution (or some aspect of it) as contrary to its ordre public — for example, the pursuit of a political dissident under the guise of a criminal prosecution or the suppression of forms of speech that the target state views as being legitimate, to say nothing of the varied views among states on what constitutes terrorism. A permissive or unguarded position on cross-border data gathering deprives a state of this sovereign capacity and allows the investigating state “to circumvent such principles.” ^{Footnote 55} Many states are also sensitive to the potential for depriving individuals of human rights protections in the form of procedural standards and would prefer that their own judiciaries or other authorities approve any evidence gathering on their territories. As the Transborder Group of the Cybercrime Convention Committee notes,

This issue has been studied a great deal, and the observation has been consistently made that, regardless of the investigational utility or the desirability of not imposing state borders on cyberspace for the purposes of enforcement jurisdiction, it is the overall view of states that this is what is required. ^{Footnote 57} This has continued to be the case well after the early twenty-first-century examples described above. One of the most recent studies, by Bert-Jaap Koops and Morag Goodwin, sums things up nicely:

In its large-scale cybercrime study released in 2013, the United Nations Office on Drugs and Crimes’s inter-governmental expert group reached a similar conclusion, producing data that indicated that two-thirds of responding states view cross-border access to computer systems or data to be impermissible and (outside limited exceptional situations) requiring access to formal channels. ^{Footnote 59} Even more recently, the United States and the United Kingdom — two powerful, technologically advanced states whose relationship of mutual trust is well known — began talks towards a treaty that would allow reciprocal direct access to both stored data and traffic data. The proposed treaty is explicitly intended to address the need for an alternative to MLAT procedures. ^{Footnote 60} The norm, then, seems to be a hard one.

VARIATIONS IN STATE PRACTICE

It is important to return to methodology at this point. Since the prohibition on extraterritorial enforcement jurisdiction is properly viewed as a customary international law norm, then the foregoing represents primarily the opinio juris quotient. States have fairly evenly expressed the view that cross-border electronic data gathering by investigative officials is an unlawful exercise of enforcement jurisdiction. However, in the complex and fast-moving world of transnational crime cases involving data, state practice is not always consistent with this view of the norms. Viewed collectively, at least, there is a certain dissonance between what states say and what they do.

When using treaty-making and legal modeling as examples of state practice, then, additional support for the prohibitive norm is observable. Aside from Article 32 of the Convention on Cybercrime and the other state practices mentioned above, the Arab Convention on Combatting Information Technology Offences contains rules regarding transborder access that can allow one to infer that acting otherwise would breach the prohibitive norm, and similar deductions can be made from the Common Market for Eastern and Southern Africa Cybersecurity Draft Model Bill. ^{Footnote 61} Moreover, the mere existence — let alone the increasing prominence — of MLATs is also at least indirect evidence of the norm.

Drilling down to the level of domestic laws and investigative activities that form state practice, however, reveals a more nuanced picture than the public attitudes of states would suggest. While not all of the data assembled on the issue necessarily tracks the formal legal positions of states, the observers who have been surveyed have noted that there is an uncertain, but significant, amount of unilateral cross-border electronic evidence gathering, or other enforcement activity, by police and security personnel. ^{Footnote 62} Some of this is simply done unilaterally by the police officers involved, while, in other situations, it is accomplished by way of direct inter-police cooperation, but without the sanction of either judicial authorities or other government apparatus of the territorial state. It is not always documented. ^{Footnote 63}

On other occasions, the authorities of the territorial state are notified after the fact. Two Dutch cases are instructive. In the first, Bredolab, Dutch law enforcement determined that a foreign-located botnet had infected millions of computers worldwide, including a number of servers located in the Netherlands. The authorities took over the botnet and sent messages to every infected computer. ^{Footnote 64} In the second, Descartes, Dutch authorities were investigating a TOR server containing child pornography that they suspected was located in the United States, and they notified American authorities about the server. When it was discovered that the server was actively posting newly made images, Dutch police copied the images for use in possible prosecutions, destroyed the images on the server, and blocked access to the server. The decision was made not to seek MLAT-based assistance because of time pressure, but the US authorities were later notified and provided with copies of the images seized; there was no objection from the United States. ^{Footnote 65}

Moreover, despite the overall tilt towards viewing such actions as sovereignty violations, a surprising number of states have laws that allow or even compel them. The controversial British Data Retention and Investigatory Powers Act of 2014 contained broad extraterritorial powers to compel data, including people and companies located outside the United Kingdom being compelled to disclose data relating to conduct outside the United Kingdom — by way of warrants served on them outside the United Kingdom. ^{Footnote 66} It has even renewed this approach in more recent proposed amendments. ^{Footnote 67} A study by the Cybercrime Convention Committee revealed that the laws of a number of Council of Europe states allow unilateral transborder access in various scenarios, including Belgium, Norway, Portugal, Serbia, and Romania. ^{Footnote 68} There are similar laws in Singapore, ^{Footnote 69} Australia, ^{Footnote 70} and, at the time of writing, similar draft legislation in Ireland. ^{Footnote 71} The US Department of Justice and the FBI have introduced amendments to Federal Rule of Criminal Procedure 41, which were recently adopted by the US Supreme Court, ^{Footnote 72} authorizing search warrants that permit remote accessing of data in other states where the location of the data is not known. ^{Footnote 73} Interestingly, the Department of Justice responded to concerns about potential sovereignty violation by pointing out that US law already permits such actions where the location of the data is known. ^{Footnote 74}

It is clear that the various imperatives that make cybercrime investigation difficult are presenting challenges to the more conservative traditional stance among states regarding extraterritorial enforcement, and, indeed, the theme of all of the literature on the topic tends to be along the lines of “we cannot do it that way any more, we need new tools.” The need for these new tools is made all the more acute by the fact that even knowing where the data is at any given moment can be difficult, due to big data companies using more fluid data storage techniques. ^{Footnote 75} Yet the tension between investigational needs and the protection of sovereignty contributes to a sense of disarray that pervades the landscape. MLAT procedures, designed to deal with exactly this issue, are felt to be too blocky and time-consuming to be effective for investigation purposes — to the point that the US government has made the curious argument in the Microsoft case that it must be allowed to subvert these procedures because they are inconvenient. ^{Footnote 76} Yet what is increasingly referred to as “the MLAT problem” is a real practical concern for law enforcement, and even the ramped-up cooperation regime in the European Convention on Cybercrime is not perceived to have helped matters much. ^{Footnote 77}

An alternative approach that initially met with some success was for police to make requests of Internet service providers, cloud storage services, and other data holders for voluntary disclosure of data, particularly in cases involving child sexual abuse and child pornography. While this is apparently lawful under Article 32 of the Convention on Cybercrime, it is deeply controversial both within and without the Council of Europe states, with many states and commentators taking the view that it is objectionable. ^{Footnote 78} Nonetheless, it was and is a fairly popular practice, ^{Footnote 79} and many of the “big data” companies have been content to comply with such requests, particularly in investigations regarding child sexual abuse or child pornography. However, this practice has begun to tail off of late, both because national courts such as the Supreme Court of Canada have blocked the practice ^{Footnote 80} and because the ripple effects of the Wikileaks revelations have made companies more insistent on domestic search warrants or production orders based on MLAT requests. ^{Footnote 81}

What is the methodological result of this situation? In short, it appears that despite overall state insistence that unauthorized cross-border evidence gathering breaches the bar on extraterritorial enforcement jurisdiction, when it comes to electronic data, state practice does not match up evenly with the opinio juris. Whether and how the traditional norm applies to the newer practices is, at best, uncertain. Such a state of uncertainty creates the potential for conflict — for example, the approach of “better to seek forgiveness than permission” illustrated in the Dutch cases mentioned above may respond to law enforcement exigencies, but the reaction from a sovereignty protection point of view would not always be positive, and, of course, the purity of the objectives would not mitigate a claim of state responsibility for the investigating state. Moreover, what is clear is that the lack of unity on the legality of the practice means that due process and human rights concerns are often being neglected.

FRAMING THE PROBLEM

Having assessed how well or poorly the traditional norm covers active police cross-border data gathering, the next step is to examine the more indirect method that is raised by the Microsoft Ireland case. The methodological question, then, is this: can State A order Individual X to produce data that X controls, but that is stored in State B? Or, in the context of the case itself, can the US government order Microsoft to produce data that is stored in Ireland for use by the state in a criminal investigation? For the present purposes, this legal question will be referred to hereafter as the “Microsoft Ireland issue.”

It is first worth noting that this discrete legal issue becoming the subject of attention is a display of the adage “everything old is new again.” The question of whether it is a breach of international law for the courts of one state to compel private parties to disclose documents located in another state is one that well predates the popular use of either electronic data storage or the Internet. Beginning in the late 1960s, such orders issued by US courts in civil litigation matters involving transnational corporations were viewed as intrusive upon domestic sovereignty by the jurisdictions targeted, including Canada, the United Kingdom, France, and Australia — each of which enacted blocking statutes to prevent the companies from complying with the foreign orders. ^{Footnote 82} Moreover, even today, the issue persists outside the cybercrime setting, as the advent of cloud storage has made it more difficult for companies involved in litigation to comply with court orders to disclose the contents of their cloud storage (or easier to refuse to comply, depending upon one’s perspective), due to concerns about infringing the laws or sovereignty of the state in which the cloud storage facility resides. ^{Footnote 83}

It is of interest that this issue has arisen once again in the US context, for as Google was at pains to point out in a recent filing in its own case on the issue, ^{Footnote 84} the American government is well aware of the sovereignty issues at play, indications of which appear in sources such as the United States Attorneys’ Manual and a Department of Justice manual on obtaining electronic evidence. ^{Footnote 85} An interesting recent (if implicit) recognition of the issue is a new practice used by US authorities in corporate criminal prosecutions: to offer cooperative credit to companies being prosecuted so that they will “voluntarily” produce documents that are in another jurisdiction. ^{Footnote 86}

This is not to say, however, that parties, courts, or governments who encounter the issue always recognize it. In the Canadian context, the most prominent case to have dealt with the kind of facts that might give rise to the Microsoft Ireland issue is eBay Canada Ltd v Canada (National Revenue), where revenue authorities invoked a section of the tax statute that provided for the compulsion of documents relevant to a tax assessment, even if they were located in another state. ^{Footnote 87} The information sought existed in electronic form on eBay’s central servers in California and was easily electronically accessible to eBay Canada’s personnel. The Canadian office’s effort to resist the disclosure order was rebuffed by two levels of court, essentially on the basis that, since the data was so easily accessible, it was “formalistic in the extreme ^{Footnote 88} to say that it was not actually in the possession of the Canadian company. The extraterritorial jurisdiction aspects of the disclosure order were avoided by this construction of the facts, though no true consideration was given to the international law issues or to the relevant state practice, perhaps because it was not raised by the parties.

As for Parliament, the Supreme Court of Canada noted in Tele-Mobile Co. v Ontario that the federal government had stated that it enacted production orders in the Criminal Code as a means of compelling individuals with possession or control over data located outside Canada to surrender it, so as to solve “the problem that has in part been created by inexpensive overseas data warehousing.” ^{Footnote 89} The implicit position is clearly that jurisdiction over the individuals who possessed or controlled the data is sufficient jurisdiction to order its production. This measure was taken seemingly without much ^{Footnote 90} consideration of whether it was consistent with international law or, indeed, without recognition that Canada itself had opposed such measures before US courts. ^{Footnote 91}

Also worth mentioning is the long-running struggle between the criminal authorities of Belgium and Yahoo, which began with a run-of-the-mill fraud investigation launched in 2007. Belgian authorities demanded that Yahoo produce Internet protocol addresses associated with email accounts that were implicated in the investigation, but Yahoo refused on the basis that it was not present in Belgium as it had no business infrastructure there and, thus, did not fall under Belgium’s territorial jurisdiction. At every stage of the proceedings, it argued that the appropriate manner for Belgium to gather the data was by way of a MLAT request. ^{Footnote 92} In December 2015, the Cour de Cassation upheld lower court rulings against Yahoo, ^{Footnote 93} on the basis that the broadcast of Yahoo’s services into Belgium gave it sufficient presence to base jurisdiction on the extended territoriality principle. Accordingly, Yahoo was required to respond to the request. The case appears to have proceeded on the assumption (similar to the Canadian position) that if Yahoo was within Belgium’s jurisdiction, the latter could lawfully demand production of the data, without any explicit consideration of the Microsoft Ireland issue. ^{Footnote 94}

To say that something is controversial or opposed in some examples of state practice is not, however, to say that the issue is settled. The Court of Appeals factums of the various parties and interveners in the Microsoft Ireland case display an interesting array of arguments that sketch out some of the major legal and policy angles. It is worth briefly reviewing some of these arguments for that reason, although the focus here will be on the international law issues rather than on the local legal peculiarities. Microsoft itself rested its argument essentially on traditional notions of extraterritorial enforcement jurisdiction: while the assertion of personal jurisdiction over the company and the actual act of disclosing the data to the government might occur on American soil, the execution of the warrant to retrieve the data happens in Ireland, where the data is stored, which amounts to extraterritorial enforcement. Even a proper interpretation of the relevant US statutes produces the conclusion that the MLAT procedure is the lawful route — not least because “in 2006, the US and EU negotiated … a self-executing treaty that expressly favours bilateral cooperation for data seizures, not unilateral intrusions into each other’s territory.” ^{Footnote 95}

Microsoft also pleaded that the case had already caused international discord, a proposition confirmed by both the record of the case and the public dialogue among the state players. Ireland filed an amici brief in the case clearly stating its view that its territorial sovereignty was implicated and that the case represented a potential infringement thereof. It also asserted that the matter was covered by the MLAT between the states and indicated its willingness to execute the MLAT process “as expeditiously as possible.” ^{Footnote 96} Finally, it pointedly mentioned its own law to the effect that Irish courts might be empowered to “order the production of records from an Irish entity on foreign soil,” but would give great weight to whether the order would violate the law of the foreign state. ^{Footnote 97}

The European Union (EU) and the Council of Europe have taken even stronger postures. A brief was filed by Jan Philipp Albrecht, German member of the European Parliament and vice-chair of its Committee on Civil Liberties, Justice and Home Affairs. He criticized the lower court decision as having “endorsed the by-passing of the EU MLAT and the respect for foreign jurisdiction inherent therein,” his main pitch being that EU privacy protection standards are significantly higher than those of the United States, and, thus, avoiding the MLAT regime prevents the oversight required by European authorities in sharing data. ^{Footnote 98} Moreover (and redolent of the earlier manifestations of this problem discussed earlier in this section), if the US court held that Microsoft must comply with the warrant, this would cause a conflict since EU laws would prohibit the transfer of data to the United States. Albrecht also noted that he was the European Parliament’s rapporteur for the current negotiations between the EU and the United States for a treaty on the protection of personal data in cooperative criminal investigations. ^{Footnote 99} Upholding the warrant, he said, “would forestall this future agreement and disturb these negotiations.” ^{Footnote 100} This view was supported by a letter from Vivane Reding, vice-president of the European Commission, in which she expressed the view that the magistrate’s decision in Microsoft Ireland “bypasses existing procedures,” is an exertion of extraterritorial jurisdiction that may breach international law, and causes companies to be caught in an untenable conflict of laws. ^{Footnote 101} A similar stance was taken by the Council of Europe’s commissioner on human rights. ^{Footnote 102}

The best international law analysis was presented in the amici brief by Anthony Colangelo of Southern Methodist University’s Dedman School of Law, who supported Microsoft’s overall position but made a number of finer methodological points. He located the central problem as a matter of determining whether the warrant actually amounts to an extraterritorial action by the United States, a question he answered in the affirmative. He emphasized the principle of non-intervention, arguing that the warrant in question is an extraterritorial extension of enforcement jurisdiction into what is clearly a sovereign territorial interest of Ireland’s, despite the fact that the intrusion is electronic rather than kinetic. ^{Footnote 103} Importantly, the question of extraterritoriality is not appropriately answered unilaterally, as the lower court did, but, rather, with due consideration of the interests and positions of the relevant states, and he submitted that great weight should be given to the views of both Ireland and the EU on this question. Finally, by circumventing the United States–Ireland MLAT, the procedure amounts to a breach of the treaty, specifically the “obligation to implement these agreements in good faith” under the Vienna Convention on the Law of Treaties. ^{Footnote 104}

The briefs of other interveners and amici made a number of a similar points as well as a host of arguments regarding the interaction of US law and international law that are not strictly relevant here. An important point made by a group led by the Electronic Frontier Foundation was that establishing this kind of warrant procedure as permissible could very well lead to foreign regimes with weaker data protection laws feeling emboldened to compel businesses with presences on their territories to surrender the personal data of American citizens ^{Footnote 105} — a strong example of the kind of “tit for tat” response that generally makes states conservative about the manner in which they exercise extraterritorial jurisdiction. ^{Footnote 106} A coalition of data firms made a similar point, giving the example of personal data of American human rights activists stored on American computers being turned over to the Russian government, a situation that illustrated the kind of “international free-for-all” that could result. ^{Footnote 107}

And the decision of the Court of Appeals? Given the amount of international law that was argued, the court’s reasons are quite anaemic, turning essentially on the difference between a warrant and a subpoena under the domestic legislation involved (the Stored Communications Act). ^{Footnote 108} Having decided that the instrument in question was actually a warrant, the court construed the warrant as a very territorially limited species of state action to which the usual statutory interpretation presumption against extraterritorial application applied. This was particularly the case here, given that the Stored Communications Act contained no language indicating any congressional intent towards extraterritorial application. The court rejected the government’s argument that the order was in fact a kind of subpoena, although it cited its own and other US case law to the effect that a subpoena requiring an individual in the United States to produce documents held abroad was lawful, without any consideration of the lawfulness of that point under international law. ^{Footnote 109}

There was little international law analysis to speak of, other than the acknowledgement that the presumption against extraterritoriality was applied in order not to interfere with international relations. The factual apogee was the court’s recognition of two points: (1) that Irish territory was implicated and (2) that Microsoft gathering the data simply amounted to the government acting indirectly rather than directly:

The high water mark of international legal analysis arrived in the tail end of the majority’s decision, in which the court brushed up against the possibility that international law norms might be breached, though under the scope of “comity” rather than law:

Despite the fact that, as indicated above, the question of whether the warrant amounted to a breach of foreign sovereignty had been argued by the parties, the Court did not really entertain the question of whether there was a prospect of unlawful extraterritorial enforcement jurisdiction. Indeed, at several points in the judgment, there are indications that the distinction between prescriptive and enforcement jurisdiction was confused by both the government ^{Footnote 112} and the court. ^{Footnote 113}

Accordingly, for all of the heated discussion around the case, it has thus far resolved very little from an international law point of view; a Supreme Court appeal might change that, but at the time of writing, none had been announced. At most, it is an example of state practice (by way of a court decision) from which it can be indirectly inferred that the state in question feels that the act might be unlawful. Much turned on the fact that warrants are treated more restrictively than subpoenas under US law, which in both practical and international law terms is a distinction without a difference — in each case, the government is compelling a party to surrender data located in the territory of another state. The issue remains the one being explored in this section: is this lawful under international law? Most important, then, is the court’s recognition that the execution of the warrant would take place in Ireland, despite being electronically initiated in the United States by a US company. As explored in detail above, this tends to be the position taken by states, and while the court did not refer to it, this view was reflected in the record. This point becomes more important in the actual international law analysis of the question, taken up the following section.

STATE PRACTICE

To the extent that the Irish and European positions expressed in the Microsoft Ireland case might be taken as expressions of opinio juris on the Microsoft Ireland issue, an examination of state practice reflects an even greater level of dissonance between opinio juris and state practice than is the case with the more general cross-border data seizure issue. In some cases, the dissonance is quite striking. For example, as mentioned above, while the United States and the United Kingdom are negotiating a treaty that will allow warrants for foreign-stored data to be executed, each has in place laws allowing the state to compel individuals within their territories to surrender data stored abroad; ^{Footnote 114} and as also noted above, despite Ireland’s sovereignty-oriented posture in the Microsoft case, it admits it has the same kinds of mechanisms available. ^{Footnote 115} While one might suspect that France would be amenable to the position expressed by the EU and European Commission officials, French courts recently asserted jurisdiction to order Twitter to produce data relating to anti-Semitic hashtags that violated French laws, ^{Footnote 116} dismissing Twitter’s protestations that the data were stored in the United States. ^{Footnote 117}

Beyond these well-publicized incidents, actual practice relating to the Microsoft Ireland issue can be difficult to track, as it tends to be rolled into the overall cross-border data question in the literature. However, a useful paper produced by international law firm Hogan Lovells in 2012 surveyed the issue quite directly with regard to ten different states, ^{Footnote 118} and some indications of other state practice can be found in the doctrinal literature. ^{Footnote 119} A chart that provided a rough illustration of this available data on state practice, then, would look like this:

There is certainly a bipolar quality to this situation. As one commentator remarked on the similar topic of surveillance, “[i]n this environment, the same action in response to a surveillance directive may be at once both legally required by one government’s laws and legally forbidden by another’s.” ^{Footnote 120}

ANALYZING THE PROBLEM

In light of the foregoing, the most that can be said about the issue from a customary international law point of view is that the current landscape reflects the overall state of play on cross-border electronic evidence gathering more generally. While states generally take a territorial sovereignty point of view, there is a dissonance between what states say (opinio juris) and what they do (state practice). In order to properly analyze the problem, then, we must resort to first principles. In my view, there is a compelling argument that a state engaging in behaviour similar to that of the US government in the Microsoft Ireland case is in breach of international law, specifically the prohibition on extraterritorial enforcement jurisdiction.

This point of view can emerge from both factual and legal analysis. Factually, a private individual is being compelled by the state to obtain data that it owns, possesses, or controls, which is stored on the territory of another state. It is important not to fall into the “computers are different” fallacy and remember that, despite its seemingly ephemeral quality, stored data like the kind at play in Microsoft Ireland is a physical thing that is quantitatively present in the foreign state. It is not truly any different than if the individual were being asked to obtain paper documents, or even tractors, from the foreign state.

Legally, the state’s power to compel the surrender of things — enforcement jurisdiction — is being extended into the territory of the foreign state, absent the latter’s permission and, in some circumstances, violating its laws. From a state responsibility point of view, it matters not that the courts or state entities issuing the compulsory orders are acting within their domestic jurisdiction and compelling entities that are within the issuing state’s territory, because the ultimate effect is extraterritorial; that is to say, the breach of the customary prohibition on extraterritorial enforcement occurs at the moment the data is gathered by the compelled entity on the foreign state’s territory and the compulsory order is consummated. The conduct is certainly attributable to the issuing state, since on any reasonable construction of the concept of agency the compelled individual is acting as the agent or proxy of the issuing state. This seems true whether the actors are properly considered to be the courts or the government and thus caught under Article 4 of the Draft Articles on State Responsibility or the compelled private individual itself, since it is under the direct control of the state and thus caught under Article 8. ^{Footnote 121}

As outlined in the first section of this article, this kind of behaviour has been considered objectionable by states since the pre-digital era. Notably, this is a kind of conduct that is not just viewed by states as being unfriendly but also as directly engaging their territorial sovereign interests, as can be seen by the various European reactions to the original Microsoft Ireland decision. As explained in the previous subsection, laws and practice at the state level can certainly be viewed as fractured, but given that international law is consent based, the most methodologically sound reaction to this situation is to revert to the more conservative, positivist position. The balance of the evidence points to the conclusion that states view this kind of compulsion as unlawful when it is directed at their territories. Accordingly, until a clearer or more nuanced picture emerges, in my view it is safe to conclude that a Microsoft Ireland-style warrant, if executed, breaches the rule against the exercise of extraterritorial enforcement jurisdiction.