MAY A U.S. COURT REQUIRE A COMMUNICATION SERVICE PROVIDER TO INTERCEPT COMMUNICATIONS IN A FOREIGN COUNTRY?

Most Americans probably assume the U.S. Wiretap Act applies only in the U.S.  It is difficult to imagine how a judge in any one country could find authority to order electronic surveillance in another country.  Nevertheless, as a practical matter the Act does permit a U.S. judge to order such surveillance, even though the suspect, the suspect’s communications device, other parties to the call, and the communications themselves, are all located outside the U.S.  That was the outcome of United States v. Rodriguez-Serna, a federal court ruling issued in southern California earlier this month. How can that be?  

The U.S. Legal Standard to Assert Jurisdiction over Lawful Surveillance 

It is well-settled law that the U.S. Wiretap Act has no extraterritorial jurisdiction. That is, U.S. wiretap law ends at our nation’s borders.  A U.S. judge cannot cite it as a basis to order electronic surveillance in a foreign country. But that’s not the end of the surveillance story. 

In the U.S., a judge may assert jurisdiction over a criminal case for purposes of authorizing electronic surveillance if any of three things related to the crime is found in the judge’s territory.  The three are: 

1. the suspect’s communications device, such as a cell phone; 
2. the intercept access point, which is the point in the communication service provider’s (CSP’s) network where the suspect’s communications are duplicated and re-routed to the law enforcement agency (LEA) monitoring point; and
3. the LEA monitoring point, where the intercepted communications are first heard and/or viewed.

In United States v. Rodriguez-Serna, the LEA investigated an illegal drug ring that spanned the U.S. and Mexico.  The LEA monitoring point was in the southern California. Hence, the southern California court asserted jurisdiction over the case and decided, based on a showing of probable cause, to order surveillance of the gang members.  

The targeted surveillance suspects were Mexican citizens.  At the time of the surveillance, they were traveling in Mexico.  Their CSP was an American wireless carrier with network infrastructure on both sides of the border. Yet despite the many Mexican features of the situation, the U.S. Federal District Court for the Southern District of California upheld the validity of the intercept due to the presence of the LEA monitoring point on U.S. soil. 

If any of the three above-listed elements of the surveillance are in the U.S., the Department of Justice has advised that the intercept must be ordered by a U.S. judge.  Otherwise the intercepting party could be prosecuted for the crime of unauthorized surveillance.  

The Potential for Jurisdictional Conflicts over Lawful Surveillance 

Liberal democracies outside the US have their own wiretap statutes.  As in the U.S., most or all those laws have no extraterritorial effect.  Also like the U.S., each foreign state considers it a crime to conduct surveillance within its boundaries without approval from a domestic court.  The result is a system where each state reserves the sovereign right to conduct surveillance on its own soil. 

Notice how international surveillance may create conflicts of law.  Let’s say a court in one state, which we’ll call Olympia, orders surveillance on a suspect based on the presence of an LEA monitoring point in Olympia.  Now suppose the suspect is talking on his cell phone in another state, which we’ll call Atlantis, and the CSP’s intercept access point is also in Atlantis.  The surveillance may be validly authorized by Olympia but still unauthorized by Atlantis because no Atlantis court has approved it.  

In this scenario, how should the CSP respond? It does not want to be prosecuted for engaging in unauthorized surveillance in Atlantis.  But it may risk an enforcement action in Olympia if it refuses to implement the valid Olympian order.  

In American criminal procedure, the “exclusionary rule” ensures that unlawfully gathered evidence may not be used against a defendant in a criminal trial.  If a judge orders an intercept but lacks jurisdiction to do so, a higher court may apply the exclusionary rule to decide that any evidence gathered from the surveillance must be thrown out. Therefore, it is not only the CSP that may suffer from a defective jurisdictional analysis.  The general public may also lose out because the legal mix-up may let a criminal go free. 

How Service Providers Avoid Jurisdictional Conflicts over Lawful Surveillance

The U.S. and all but a few countries have signed treaties that shield CSPs from getting sandbagged in jurisdictional conflicts over lawful surveillance.  Under these mutual legal assistance treaties, or “MLATs,” if a court in Olympia serves an order on a CSP in Atlantis to conduct surveillance in Atlantis, the CSP may validly say no.  The Olympia LEA would then invoke a legal process through which the ministry of justice in Olympia would ask the ministry of justice in Atlantis for help. Upon approval from the ministry in Atlantis, an LEA in Atlantis would serve a surveillance order on the CSP, and the CSP could implement it without fear of violating Olympia’s laws.  

MLAT treaties honor the principle of state sovereignty, where each state controls surveillance within its own contours.  Therefore, the treaties avoid the most common type of jurisdictional conflict that a surveillance order may cause. Nevertheless, MLATs do not address all surveillance scenarios.  Imagine a case where a court in Olympia validly orders a CSP in Olympia to conduct surveillance, even though elements of the investigation lie across the border. That is the dilemma posed in United States v. Rodriguez-Serna.  The international community has not yet solved this type of conflict. A solution would require them to reconcile many conflicting jurisdictional laws.  

A CSP caught in the above legal vice should consult counsel, ideally someone with expertise in the laws of both governments.  Often, a conversation with the applicable LEA can lead to a work-around, such as where investigators modify their plan of attack to avoid CSP friction with foreign laws.  If the LEA can gather the communications evidence it needs, it will not need to initiate an enforcement action against the CSP. 

European CSPs are better protected from surveillance conflicts.  Most E.U. states have signed a special European treaty that permits surveillance agents to follow a suspect across a border without violating the laws of the neighboring jurisdiction.  Let’s say a German court orders a German CSP to activate surveillance on a suspect with a cell phone. If the suspect drives from Germany to Italy, the CSP would notify the German LEA, and the LEA would alert its counterpart in Italy.  At that point, the Italian authority could halt the surveillance, continue the surveillance through its own laws and technology, or simply consent to the continuation of the German monitoring. The CSP would simply follow the option chosen by the Italian official.  

One other initiative may rescue CSPs from the surveillance jurisdiction trap.  The U.S. and Great Britain are negotiating an agreement that would permit an LEA in either country to order surveillance by a CSP in the other country.  The arrangement would avoid the MLAT process, which is widely considered slow and unreliable. At the same time, it would guarantee a common baseline of due process and privacy protection. Success in this legal experiment could persuade other democracies to follow suit. 

Different impacts on different networks

Any analysis of a CSP’s international surveillance law obligations must examine not only the surveillance laws in the governing jurisdictions but the composition of the CSP’s network.  Different network architectures require different types of surveillance solutions, and some solutions offer more flexibility than others for purposes of choosing the country or countries where they are deployed.  In United States v. Rodriguez-Serna, the CSP operated a traditional wireless network, where communications were captured at a mobile switching center in Mexico.  A hosted VoIP provider might house its surveillance solution in the data center where its subscriber communications are processed, even though the CSP serves subscribers in other jurisdictions.   A satellite operator might deploy its intercept access point in any of numerous countries covered by its service footprint.  

In light of the above complexities, an international CSP should design its surveillance law compliance strategy in close coordination with a surveillance law expert and a communications engineer, with all conversations protected by a nondisclosure agreement. Otherwise the CSP could end up spending a lot of money on a compliance plan that does more legal harm than good. 

Maybe one day lawyers will reconcile all the surveillance law conflicts in the world.  Of course, that could take a while.