Bond Law academic, Professor Dan Svantesson, has been part of a landmark international contact group set up to explore new legal frameworks for accessing internet data across international borders.
His work for the Paris-based Internet & Jurisdiction Policy Network directly correlates to one of the most closely watched cases currently before the US Supreme Court, between Microsoft and the US Department of Justice.
“Basically, the Department of Justice is trying to enforce a search warrant in a drug trafficking case, ordering Microsoft to hand over emails which are held on the company’s servers in Ireland,” said Professor Svantesson, who serves as Co-Director of the Centre for Commercial Law, based at Bond University.
“The case has been going on since 2014, based on the question of whether the Department of Justice’s search warrants reach beyond US borders.”
It’s a case that impacts on the security of private emails and other data held in ‘cloud’ services operated by predominantly American companies such as Amazon, Google, IBM and Microsoft, and it has attracted court briefs and petitions from interested parties all over the world, including Privacy International, the New Zealand Privacy Commission and more than 50 leading computer scientists.
“These sorts of multi-jurisdictional battles are becoming increasingly common as we embrace a more globalised marketplace so it is vital that governments and legal experts work together to find practical solutions,” said Professor Svantesson.
Which is exactly what he has been part of doing for the past 18 months as a member of an international contact group set up by the Secretariat of the Internet & Jurisdiction Policy Network to look at various legal options for governing cross-border access to user data.
“Criminal investigations increasingly require access to information about users and digital evidence that is stored by private companies in overseas jurisdictions,” he said.
“As can be seen by the Microsoft case, many of the relevant laws were written at a time before anyone even considered the possibility of data stored in the ‘cloud’.
“The problem is further compounded by the difficulties of determining location and jurisdictional nexus in investigations, while ensuring that we maintain suitable levels of protection for fundamental rights such as data privacy.”
Professor Svantesson has been a member since 2012 of the Internet & Jurisdiction Policy Network’s Observatory, an international group of academics, but his involvement in preparing the Data and Jurisdiction Policy Options Document came about when he was the only academic speaker invited to present at an expert conference organised by the Dutch EU Council Presidency in March 2016.
“This was a real career highlight for me,” he said. “It was very satisfying to see that my ideas are of interest to Europe’s chief law makers and that I was potentially able to help shape the EU’s future direction in the law enforcement of cloud computing.”
Later that year, Professor Svantesson was one of only three academics invited by the Secretariat of the Policy Network to be part of an international team of legal experts drawn from the tech industry (e.g. Google, Apple, Facebook), government authorities, international organisations (INTERPOL, the Council of Europe, the European Union) and other stakeholders. He was also the only member of the 19-strong group representing an Australian organisation.
“At the first Global Internet and Jurisdiction Conference in November 2016 in Paris, the Secretariat of the Policy Network established three groups to look at content restrictions, domain suspension and cross-border access to user data – which is the group I have been part of,” he said.
“Over the following months, we held a series of e-meetings to look at how current practices for cross-border user data requests by law enforcement agencies can be improved.”
The group’s report looks at various options and possible components for a voluntary framework to manage data access requests on a global scale.
It will serve as input for the second Global Internet and Jurisdiction Conference, which is currently being held in Canada (February 26 to 28) – coincidentally at the exact same time that the United States of America v MicrosoftCorporation case is being heard in the US Supreme Court.
“It has been fascinating to work with people from so many different perspectives and backgrounds,” said Professor Svantesson.
“And it will be interesting to see the comments and feedback now from the broader network and to consider how we can work together to develop some practical and workable solutions.”