U.S. and France as a Case Study for Mutual Legal Assistance Challenges and Reform

This post is part of a series written by participants of a conference at Georgia Tech in Surveillance, Privacy, and Data Across Borders: Trans-Atlantic Perspectives.

Discussions about the reform of Mutual Legal Assistance systems must take into account a variety of factors, from the laws and safeguards of each country, including their practical applications, to the broader frameworks evolving in these countries.

The United States and the European Union have remarkably different data protection laws. Privacy laws in the U.S. are sectoral, while the EU takes an omnibus approach. When it comes to access to evidence by law enforcement, the differences between the two systems are even more pronounced. First and foremost, the European Union does not have a single overarching legislation regarding law enforcement’s access to evidence. Because criminal procedure law is left to the sovereignty of EU Member States, little room remains for the EU to legislate on the topic. This does not mean, however, that there is a complete absence of European frameworks in regards to the exchange of criminal evidence. Such frameworks include the Budapest Convention, the directive on the protection of natural persons with regard to the processing of personal data for law enforcement, and the directive on the European Investigation Order, which will become effective May 22, 2017. Thus, to fully understand the system of law enforcement access to evidence, we need a thorough understanding of Member States' laws. This article provides an overview of recent research Peter Swire, Justin Hemmings and I conducted on the legal regimes for law enforcement access to data in the United States and France. Our research demonstrates the importance of establishing a framework that allows us to take into consideration the evolution of liberties in other legal regimes.

Varying systems of safeguards

The United States has created a multi-tiered set of standards with different rules for different categories of electronic evidence:

1. The Fourth Amendment does not protect metadata, such as basic subscriber information (BSI). The government can attempt to obtain BSI through an administrative subpoena, grand jury or trial subpoena, or a court order. A company can also voluntarily disclose BSI to law enforcement upon request without penalty. For dialing, routing, addressing, and signaling information (DRAS), criminal prosecutors can obtain a pen/trap order by certifying to the court that the information likely to be obtained is relevant to an ongoing criminal investigation. The Patriot Act provides nationwide scope for the order.

2. For other metadata, such as location information, the Stored Communications Act requires a court order (a so-called “D order”) for the production of certain stored records. These D orders require a showing of specific and articulable fact that the information sought is relevant and material to an ongoing criminal investigation.

3. Under the Warshak ruling, the government needs to obtain a probable cause warrant to gain access to the content of stored electronic communications.

4. Electronic data intercepted in real time holds the greatest privacy risks and therefore requires a heightened standard of proof. In addition to showing probable cause, other requirements must also be fulfilled for real-time interception, such as the exhaustion of less intrusive investigatory procedures.

5. Law enforcement in the U.S. can also obtain evidence through other means, including voluntary disclosure by companies, subpoena, grand jury subpoena, and mandatory reporting.

The French system, on the other hand, is based on different sets of rules applying to the various stages of investigation also depending on the investigative power of the relevant actors. Recently, French prosecutorial powers and influence have increased, thereby reducing the investigating magistrate’s role both within the criminal and investigation procedures.

Under these various French regimes, different standards of proof are required and different actors can ask for different categories of electronic evidence. Only a subset of these regimes will be discussed in this article.

Search and seizure, for instance, have different rule sets for different investigation stages. When a suspect is caught in flagrante delicto, the search is permitted only if the nature of the crime is such that proof can likely be obtained by seizure of the information, and if the person whose home is searched is present. For preliminary investigations, the Officers of the Judicial Police need to obtain the written consent of the person whose home is to be searched. For formal investigations, the Code of Criminal Procedure provides for broad powers of the investigating magistrate to order the search of any place for discovering objects or data, requiring only that the search be necessary to establish the reality of an offense.

Meanwhile, the interception of telecommunications can only be ordered in cases involving criminal offenses and misdemeanors subject to imprisonment of at least two years, and when the circumstances of the case do require interception. A recent reform from July 2016 granted the power to order such interception to the liberties and custody judge (and no longer solely the investigating magistrate), and allowed remote access to emails without the user’s knowledge.

The differences that exist between the French and U.S. systems demonstrate how safeguards can operate in quite different ways in different countries—for example, by category of evidence in the U.S. and by power of the investigating authority in France.

Rolling back safeguards

It is important to note that a country can quickly enact reforms that undermine the existing safeguards in its legal framework. For example, France has extended its current state of emergency five times since emergency was first declared in November 2015, following the deadly attacks in Paris, and amended its criminal procedure system in June 2016 to reflect such changes. The state of emergency regime provides extensive police powers, conferring extraordinary capacities to the Minister of the Interior and to the Prefect of Regions (State’s representative in the region).

One of the many measures in the state of emergency allows the Minister of Interior to impose house arrest on an individual whose behavior may constitute a threat to public security and order. The Ministry of Interior also gains limited control over the press, including the ability to interrupt online communication services inducing or glorifying terrorist acts. Similarly, the state of emergency provides the Prefect of Regions different ways to restrict freedom of movement within their jurisdiction, and the Council of Ministers with the power to dissolve associations that participate, facilitate, or incite to commit serious offenses to public order.

Under the state of emergency, rules regarding the collection of and access to evidence are highly intrusive and may affect civil liberties. For example, the law allows both the Minister of Interior and the Prefect of Regions to order warrantless searches at any location and at any time if there is serious reason to believe that the location is frequented by a person whose conduct constitutes a threat to security and public order. The state of emergency also provides broad powers to the Officers of the Judicial Police regarding access to electronic evidence. This provision was censured multiple times (here and here) by the Constitutional Council, which considered that a reasonable balance between safeguarding public order and the right to privacy was not achieved.

It is essential to ensure that legal safeguards are maintained when reforming an existing model of cooperation such as the Mutual Legal Assistance Treaties. Otherwise, reform has the potential to weaken civil rights by seeking the lowest common denominator among systems.