B. Direct Remote Access

Faced with the limitations of mutual legal assistance requests, some States are tempted to unilaterally carry out extraterritorial network searches on foreign computers or servers with a view to securing evidence for use in criminal proceedings. Various techniques can be used in this respect. One technique is for law-enforcement authorities to simply seize and search a device, for example a mobile phone, on their territory and remotely access foreign-stored data accessible from it.^{Footnote 26} This technique was at issue in the aforementioned Tidal case.^{Footnote 27} Another—more extreme—technique is “state hacking,” for example, law-enforcement authorities breaking directly into computers and searching networks outside the State. There is anecdotal evidence that authorities use such techniques to remotely access and control the “dark web,” where illegal activities and transactions take place, such as the exchange of child pornography and the sale of narcotics and weapons.^{Footnote 28}

Techniques of remote access may have a domestic legal basis,^{Footnote 29} although it is a public secret that in some States, law-enforcement agencies carry out remote searches without domestic authorization.^{Footnote 30} In any event, there is no clear authorization under international law for such searches. As they amount to investigative acts that are eventually performed on the territory of another State, they appear to fall foul of the prohibition of extraterritorial enforcement jurisdiction, in the absence of ad hoc State consent or treaty arrangements.^{Footnote 31} Multilateral treaty arrangements explicitly authorizing such acts do not currently exist. Article 19.1 of the Budapest Convention on Cybercrime—the leading multilateral convention on cybercrime, which counts 66 Contracting Parties—empowers States to search and seize stored computer data, but explicitly limits this power to States’ territory.^{Footnote 32} Admittedly, Article 32(b) of the same Convention on Cybercrime allows States Parties to “access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system.”Footnote ³³ However, it is not clear whose consent precisely has to be obtained under this article. It is unlikely to be the service provider, as the provider may not have the lawful authority to disclose the data. More likely, consent has to be obtained from the suspect himself—consent which, for obvious reasons, he is unlikely to give.^{Footnote 34} Accordingly, Article 32(b) of the Convention on Cybercrime does not provide a legal basis for extraterritorial network searches.Footnote ³⁵ Moreover, the provision is only workable in case the location of the data is known; it does not provide a solution in case of loss of knowledge of location.

Multilateral arrangements governing direct remote access are not expected in the short term. While an additional Protocol to the Budapest Convention is currently under negotiation, its draft provisions only strengthen mutual legal assistance procedures, while making limited allowance for extraterritorial production orders.Footnote ³⁶ The draft text remains silent on direct remote access.

Nevertheless, it has been argued that remote network searches are, or should be authorized under international law, at least under certain circumstances. Various arguments have been advanced in this respect. The most extreme argument is that such searches are not extraterritorial in the first place, because the law-enforcement agencies carrying out the search remain in their own territory.^{Footnote 37} This argument is not overly convincing, as the search itself clearly takes place abroad. An arguably more common trope acknowledges that remote searches have an extraterritorial dimension, but that they can be justified on the basis of principles and doctrines of prescriptive jurisdiction. Thus, the Dutch Government explicitly bases investigative enforcement jurisdiction in cyberspace on prescriptive jurisdiction, and relies on the territorial ubiquity principle to justify enforcement jurisdiction.^{Footnote 38} On this view, extraterritorial enforcement jurisdiction over data stored abroad is parasitic on the existence of lawful prescriptive jurisdiction. A variation is that extraterritorial enforcement is allowed insofar as the suspect resides on the territory of the enforcing State or holds its nationality.^{Footnote 39} Also such a view takes its cue from the law of prescriptive jurisdiction. Indeed, as Jan Spoenle points out, “[t]hese references to the traditional territorial and active personality principles of general criminal jurisdiction might prove useful in reaching a consensus on establishing such a measure.”^{Footnote 40} A final view has it that enforcement is allowed if the search pertains to serious crime which has a major effect on the State carrying out the search, or to offenses that are internationally considered as particularly grave.^{Footnote 41} Such a view appears to draw on the effects doctrine and the universality principle under the law of prescriptive jurisdiction.

Where advocates of extraterritorial enforcement jurisdiction do not directly rely on permissive principles of prescriptive jurisdiction, they may instead rely, albeit implicitly, on the concept of jurisdictional reasonableness, which was also developed in the law of prescriptive jurisdiction as a tool of restraint to manage overlapping claims of prescriptive jurisdiction.^{Footnote 42} Reasonableness operates on the basis of a weighting of connections and interests of the various States potentially involved in the matter. Under this rubric, we may find a variety of arguments. For one, it can be considered reasonable for States to carry out remote searches in case of loss of (knowledge of) location.^{Footnote 43} Indeed, when the foreign State is not even aware that the data is located on its territory, it cannot be said to have a strong interest in opposing such searches—although it may be a good practice to seek its consent once the location is identified.^{Footnote 44} For another, it may be reasonable for a State to exercise enforcement jurisdiction where the enforcing State has validly obtained a user’s login credentials, for example through user consent, or via wiretapping,^{Footnote 45} and this user is based in the territory, such as in the abovementioned Tidal decisions of the Norwegian Supreme Court.

Most commonly, advocates formulate a number of factors that serve as elements of an overall reasonableness-based interest-balancing test that ultimately informs decisions on extraterritorial enforcement. For instance, the explanatory memorandum accompanying the Dutch Act authorizing extraterritorial network searches lists as criteria

The territorial location of data, devices or networks is only one element of this test, and not the decisive one. Accordingly, this shift to reasonableness, and more generally the importation of notions belonging to the law of prescriptive jurisdiction, has the effect of drastically reducing the importance of strict territoriality as the linchpin of the law of enforcement jurisdiction. Territory is replaced by such flexible notions as effects, connections, and interests.

Nevertheless, donning the lens of a positivist lawyer, one would be hard-pressed to conclude that customary international law already allows for extraterritorial network searches.^{Footnote 47} Actual State practice remains limited after all. Moreover, it is not always publicly admitted, which disqualifies it as relevant practice for the formation of customary international law. At the same time, (public) foreign protest against such searches is few and far between.^{Footnote 48} Quite possibly, States prefer not to have their hands tied: Today’s gamekeepers may become tomorrow’s poachers. Accordingly, the practice of extraterritorial network searches is likely to remain in international legal limbo for some time. Nonetheless, this absence of legal certainty is unlikely to deter proactive States from taking measures to prevent the Internet from becoming a safe haven for criminals.^{Footnote 49}

C. Indirect Access—Production Orders

Apart from using direct means to access data held abroad, States also use means of indirect access. States can acquire indirect access to data by ordering Internet intermediaries to produce user data located abroad, for example the subscriber, traffic or content data relating to an email account stored on a foreign server,^{Footnote 50} possibly backed up with subpoena threats.^{Footnote 51} These Internet intermediaries may be incorporated in the territory, may have a representative there, or simply offer services to users based there.

Also, such production orders appear to be in tension with the prohibition of extraterritorial enforcement jurisdiction, as they bypass the consent of the territorial State. From the perspective of the territorial State, it may not matter much whether the data is directly or indirectly accessed by a foreign State. In both instances, the foreign State appears to carry out investigative measures on another State’s territory.

Still, as such production orders are perceived to not directly intrude on a server abroad, there appears to be substantial international willingness to legally support them, at least within certain bounds. Under the US CLOUD Act, US law-enforcement agencies can now order -US-based Internet intermediaries to disclose information within their possession or control, regardless of location.^{Footnote 52} Other States, notably Belgium, have gone even further, and have ordered foreign-based Internet intermediaries to produce data to be used as evidence in domestic criminal investigations.^{Footnote 53} The European Union is currently mulling its own version of the CLOUD Act, on the basis of a Commission proposal of 2018.^{Footnote 54} Under the Commission’s proposal, judicial authorities in one EU Member State would be allowed to request (meta-)data from Internet intermediaries, including non-EU-based intermediaries which offer services in the -EU-, regardless of data location.^{Footnote 55}

In the meantime, the Cybercrime Convention Committee has prepared a Second Additional Protocol to the Budapest Convention on Cybercrime, opened for signature in May 2022, which authorizes extraterritorial production orders pertaining to subscriber information.^{Footnote 56} This Additional Protocol could further clarify the scope of Article 18(1)(b) of the Budapest Convention, which provides that “[e]ach Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to order a service provider offering its services in the territory of the Party to submit subscriber information relating to such services in that service provider’s possession or control.”Footnote ⁵⁷ The Cybercrime Convention Committee espoused a wide reading of this provision, and posited that it allowed extraterritorial production orders in relation to subscriber information stored abroad and controlled by foreign service providers, as far as those providers offer services in the territory.^{Footnote 58} However, as a Second Additional Protocol addressing—inter alia—extraterritorial production orders was considered necessary, it is more likely that for some Contracting Parties the liberal interpretation of Article 18(1)(b) of the Budapest Convention was a bridge too far, even in respect of providers offering services in the territory.^{Footnote 59} Julia Hörnle has observed in this respect that Article 18 only creates a power under the domestic criminal procedures of Contracting Parties to the Convention, and “does not force the receiving state to cede sovereignty to the investigating state,” which is under “no obligation to recognize or enforce the request outside MLA.”^{Footnote 60}

The arguments proffered in favor of the international lawfulness of extraterritorial production orders somewhat mirror the arguments in favor of direct access. In perhaps a slightly more convincing manner, it has been submitted that orders for the production of foreign data are not truly extraterritorial insofar as they are directed at providers over which States have territorial or personal jurisdiction anyway.^{Footnote 61} Such an argument is in fact a replay of an older US argument that discovery orders compelling US-based persons to produce documents they held abroad do not amount to an exercise of extraterritorial enforcement jurisdiction, but are simply territorial in nature.^{Footnote 62} Somewhat similarly, the Belgian Court of Cassation ruled that ordering a provider (Skype) to produce data located abroad or to perform a wiretap does not amount to an intervention of Belgian law-enforcement authorities abroad, as this only implies a duty of cooperation on the part of the provider.^{Footnote 63} A related, but also different argument is that, while production orders may have an extraterritorial dimension, such orders may be justified insofar as their addressees offer services on the territory of the issuing State, and thus participate in economic activities there.^{Footnote 64} The logic at play here is that, where a State has prescriptive jurisdiction over the activities of Internet intermediaries offering services to users on its territory,^{Footnote 65} it has ancillary enforcement jurisdiction over data controlled by these intermediaries, regardless of location.^{Footnote 66} Such an argument again conceives of enforcement jurisdiction as following prescriptive jurisdiction, in particular the effects doctrine. This comes with a twist, however, as the enforcement action does not normally assist criminal proceedings brought against the intermediary itself, but rather against an individual user, or suspect.

Admittedly, advocates of collapsing the distinction between prescription and enforcement are cognizant of the danger of jurisdictional overreach resulting from the application of the effects doctrine to the law of enforcement jurisdiction. Acknowledgement of this danger does not lead them to abandon extraterritorial production orders altogether, but rather to favor the adoption of mitigating principles or safeguards.^{Footnote 67} Adoption of such principles serves the purpose of legitimating the extraterritorial claim. Strikingly, these principles also draw on the law of prescriptive jurisdiction, in particular the notions of genuine connection^{Footnote 68} and reasonableness.

Just like in the context of restraints on direct access, these notions may take different forms. Most obviously, States may require that the issuing State notify the State where the data sought is located, or where the intermediary is incorporated.^{Footnote 69} That said, more elaborate mitigation mechanisms can certainly be envisaged. The European Commission’s proposal for the Regulation for a European Production Order (EPO) offers a good illustration.Footnote ⁷⁰ First, the scope ratione personae of the proposal is explicitly limited to providers offering services in the EU which have “a substantial connection to the Member State(s).”^{Footnote 71} Second, under the proposal, EPOs for the production of transactional or content data can only be issued for more serious criminal offenses—whereas orders for the production of subscriber and access data can be issued for all offenses.^{Footnote 72} Third, the EPO proposal features detailed, comity-based provisions on a review procedure where “compliance with the -EPO- would conflict with applicable laws of a third country prohibiting disclosure of the data concerned.”^{Footnote 73} Most striking is the multifactor weighting test which a competent EU-based court is required to apply in case of conflicting obligations based on considerations other than fundamental rights or fundamental interests of a third country.^{Footnote 74} When determining whether to uphold or withdraw the EPO, the court is called on to pay heed to such factors as the third country’s interest, the degree of connection to the relevant States, and the seriousness of the offence.^{Footnote 75} Such a multi-factor test, weighting multiple interests and connections, is a classic reasonableness test aimed at managing overlapping prescriptive jurisdiction and conflicting legal requirements.^{Footnote 76} In the field of enforcement jurisdiction, such a test prevents that extraterritorial production orders unduly encroach on third States’ sovereignty and catch providers between a rock and hard place. At the same time, and most importantly, this mechanism of restraint also serves to justify the extraterritoriality of specific production orders.

As demonstrated by recent evolutions in the US, the EU and in the context of the Budapest Convention, there is an international dynamic at play in favor of more liberal rules for extraterritorial production orders, even if hemmed in by a number of jurisdictional restraints. However, this dynamic is far from uncontested. For one thing, the EU Commission proposal has not yet been adopted. In fact, rather drastic amendments have recently been proposed by the European Parliament.^{Footnote 77} For another, the Second Additional Protocol to the Budapest Convention is unlikely to command the support of all States Parties to the Budapest Convention,^{Footnote 78} given the wide divergences between the Contracting Parties. Moreover, the Protocol allows for the imposition of additional conditions as well as the possibility to append a reservation, which may not just mitigate but altogether exclude the compulsory nature of extraterritorial production orders.^{Footnote 79} What is more, even without reservations of their home States, foreign-based addressees of production order have the right not to disclose the relevant data, in which case only mutual legal assistance can be pursued.^{Footnote 80} If voluntary compliance remains the norm internationally,^{Footnote 81} extraterritorial production orders amount to mere requests which can be disregarded without penalty. They hardly qualify as instances of genuine extraterritorial enforcement jurisdiction.

D. Assessing Current Evolutions

The most eye-catching effect of digitalization on the law of enforcement jurisdiction, as follows from the discussion in the previous sections, is the fading into irrelevance of territoriality. Territoriality has been the bedrock principle of the law of jurisdiction, at least since the Peace of Westphalia. In respect of digital data, however, enforcement jurisdiction no longer follows the geographic location of the evidence sought. The Proposal for a European Production Order cannot be more clear in this respect, where it states that “the data storage location by itself does not suffice in establishing a substantial degree of connection.”^{Footnote 82} In cyberspace, the territorial location of data at a given time is simply a function of algorithmic decisions of Internet intermediaries offering global cloud computing services. In order to retain their relevance, jurisdictional rules may have to bend to technological realities.^{Footnote 83} From a criminal law perspective, maintaining strict territoriality would encourage providers to store data on servers in “safe havens,” a clearly undesirable outcome.^{Footnote 84} In some circumstances, moreover, the exact location of data may even be unknown, which renders reliance on territoriality a non-starter to begin with.^{Footnote 85} Insofar as the “physical” location of digital data—on a server—may be entirely fortuitous, and may in fact not be known by the territorial State, that State cannot reasonably invoke its territorial sovereignty as a shield against another State’s jurisdictional claims over such data.

Accordingly, normatively speaking, the better option may be to accept the principled international lawfulness of “extraterritorial” enforcement jurisdiction over digital data, possibly by redefining it as a form of extraterritorial “investigative” jurisdiction in cyberspace.^{Footnote 86} This would leave intact the traditional prohibition of extraterritorial enforcement jurisdiction in the non-cyber domain, where territorial boundaries are still very much in existence. In the physical realm, there is in any event no indication of State practice and opinio juris in favor of a relaxation of the prohibition. That said, there may be one exception: in the case of human and drugs trafficking on the high seas, we see that some states exercise enforcement jurisdiction over vessels in apparent excess of what is allowed under the UN Convention on the Law of the Sea, a practice which may in due course lead to the crystallization of a new permissive customary norm.^{Footnote 87} However, given the physical characteristics of the oceans, enforcement jurisdiction at sea has always been subject to a regime different from the general regime governing enforcement jurisdiction on land.

In order to adequately tackle crime in the Internet era, States should be granted more leeway to exercise enforcement—or investigative—jurisdiction over data, regardless of data location. However, to prevent a jurisdictional free-for-all, it is key that that the exercise of extraterritorial enforcement jurisdiction in cyberspace becomes subject to a stringent test weighting all relevant connections and interests in concrete cases. Introducing such a weighting test means that extraterritorial enforcement jurisdiction is no longer governed by binary rules (allowed or not allowed), but becomes a matter of degree, requiring a granular, contextual assessment. What may be acceptable in some circumstances, may be unacceptable in other circumstances.

Such flexibility has long been a characteristic of the law of prescriptive jurisdiction, where lawfulness is assessed in concreto by making use of such malleable concepts as effects, ubiquity, genuine connection, and reasonableness. It appears that these notions are now migrating to the law of enforcement jurisdiction in cyberspace. Thus, digitization is blurring the lines between the rigid law of enforcement jurisdiction and the more flexible law of prescriptive jurisdiction. Critics may perhaps object that such a “post-modern,” case-by-case approach may lack predictability and legal certainty. However, this approach is hardly novel. It has not only been applied for quite some time in the law of prescriptive jurisdiction, but has an even longer pedigree in the conflict of laws—private international law. Especially in the -US-, the flexible notion of comity has been instrumental in solving disputes with cross-border elements.^{Footnote 88}

Nevertheless, this flexible attitude towards extraterritorial enforcement jurisdiction is not universally shared. There is no denying that relevant State practice and expert opinion in favor of the “un-territoriality of data” has a particular Western slant. Moreover, even within the West, contestation continues, as testified by the very limited public State practice in support of direct access, as well as the vicissitudes of the -EPO- and the Second Additional Protocol to the Budapest Convention.Footnote ⁸⁹ Such contestation may largely pertain to the boundary conditions for the valid exercise of extraterritorial enforcement jurisdiction, but given the close link of these conditions with the principled lawfulness of such jurisdiction, it can hardly be discounted.

States which jealously guard their sovereignty and see an open Internet as a threat rather than a blessing will probably continue to treat digital evidence as any other piece of evidence and subject it to territorial jurisdiction. Such States may require that Internet intermediaries store data within their territory (“data localization”), thereby obviating the need for extraterritorial access. These States are not standing idly by, for that matter. Russia has recently circulated a proposal for a Draft United Nations Convention on Cooperation in Combating Information Crimes, which conspicuously does not provide for extraterritorial production orders.^{Footnote 90} While this proposal has not yet gained a lot of traction within the UN, the challenge to the Western approach to law-enforcement in cyberspace, and more generally the conceptualization of cyberspace as an open space, is unmistakable.^{Footnote 91}

In light of these diverging approaches, universal customary international law regarding such orders is unlikely to crystallize. More likely is the crystallization of customary norms of regional scope, comprising (Western-oriented) liberal democracies with an open Internet. In parallel, such States may mutually adopt bilateral treaties in which they reciprocally recognize the validity of extraterritorial production orders, subject to the necessary safeguards.^{Footnote 92}