Matthias Monroy

No less than three international organisations are working on different agreements to ease access to servers abroad for police and judiciary. In the Council of Europe, the EU Commission might pre-empt the United Nations. Problems arise with demands from the USA.

65 states have ratified the Additional Protocol to the Council of Europe Cybercrime Convention, and three more may join. The 2001 treaty is also known as the Budapest Convention. For three years now, the participants have been negotiating a new version, which should facilitate cross-border access to “Electronic Evidence” in criminal investigations.

Negotiations on the conclusion of the new mutual legal assistance agreement will now be delayed by at least six months. This was announced by the Cybercrime Committee of the Council of Europe after its meeting on 30 November. The new timetable provides that the agreement can be concluded in May 2021 at the earliest.

EU Council wants „Disconnection Clause“

All 27 EU Member States, as members of the Council of Europe, have also signed the Budapest Convention. Although they are therefore involved in the negotiations, they have issued a joint mandate to the EU Commission. It is responsible for ensuring that the new Additional Protocol is in line with EU law. The Council also wants a “Disconnection Clause” to ensure that the European Union adopts its own laws on “Electronic Evidence” and that these are given priority in investigative requests between EU member states.

According to the committee responsible, there have already been six plenary sessions on the revision of the Budapest Convention, 15 meetings to discuss the draft and several encounters of subgroups and committees. Since March, all discussions have only taken place online. However, the reasons for the delay are political differences. Controversial issues include different standards on the right to correct and delete data of persons affected or special regulations for federal states.

Dispute over covert investigations

Additional problems are posed by the demands of some states for an “Extension of Searches” and for special “Investigation Techniques”. This refers to cases in which authorities, after seizing a device or obtaining login data, access accounts of the persons concerned and thus carry out further investigations on the Internet. In the European Union, according to the Commission, this is already possible in 20 Member States, and the Budapest Convention should therefore make the same rule applicable to foreign servers. However, this could mean that seven EU Member States could not accede to the new Additional Protocol because the measure is not allowed in their country.

The United States, which is also a party to the Budapest Convention, is also likely to be one of the obstacles in the negotiations. In the negotiations on the recast, the United States is demanding permission for “Undercover Investigations”. These are covert operations in which the police use a false identity and then copy, for example, chats of suspects as “Electronic Evidence”. However, if these data were stored on servers in another state, this could be a sovereign task for which permission must first be sought.

EU-US negotiations halted

At the same time, the US administration in Washington is negotiating with the Commission for an exclusive EU-US agreement. After all, just like the Council of Europe, the European Union wants to adopt its own regulation on preserving and handing out “Electronic Evidence”. In doing so, however, the EU member states are dependent on the goodwill of the government in Washington.

Many internet service providers who are supposed to release data to police and intelligence services are based in the USA. The US Department of Justice could allow European authorities under the proposed EU regulation to make direct requests to companies, bypassing the usual international judicial procedure. In return for such an administrative agreement under the so-called CLOUD Act, EU Member States should also grant privileges to US security authorities.

In June 2019, the Council gave a mandate to the Commission to negotiate the EU-US agreement, with rounds being prepared in the EU Council Working Party on Cooperation in Criminal Matters (COPEN). First of all, the parties have defined what is to be negotiated. However, due to the Corona pandemic, the talks are on hold.

United Nations for global agreement

However, even in the absence of a pandemic, the Commission would have to halt the negotiations with the US Department of Justice. This is because the contours of the planned EU regulation must first become visible before the concrete form of an additional agreement can be discussed with the USA. However, the start of the trialogue with the Council and the Commission has also been delayed due to the pandemic. Today, the Committee on Civil Liberties, Justice and Home Affairs in the EU Parliament is discussing its position towards the proposal for a regulation.

However, it is questionable why an EU-wide “Electronic Evidence” regime is needed at all. After all, all EU members can request more than twice as many states to cooperate in digital investigations via the Council of Europe than would be possible via an EU regulation.

But the Budapest Convention could also become superfluous after the United Nations, against the votes of the EU governments and the USA, last year also adopted a resolution at Russia’s request for a worldwide mutual legal assistance agreement to fight cybercrime. A working group is now to prepare a first draft. The move was criticized by an Open letter to the UN General Assembly, in which 38 NGO’s demand “improving” existing instruments instead of creating new ones.

Image: “Crime Scene Tape” by Null Value, licensed under CC BY-NC-ND 2.0.