Extraterritorial Enforcement Jurisdiction in Cyberspace: Normative Shifts

Abstract

The most eye-catching effect of digitalization on the law of enforcement jurisdiction is the fading into irrelevance of territoriality. Insofar as the “physical” location of digital data—on a server—may be entirely fortuitous and may in fact not be known by the territorial state, it appears unreasonable for that state to invoke its territorial sovereignty as a shield against another state’s claims over such data. To prevent a jurisdictional free-for-all, however, it is key that the exercise of extraterritorial enforcement jurisdiction in cyberspace becomes subject to a stringent test weighting all relevant connections and interests in concrete cases. Introducing such a weighting test means that extraterritorial enforcement jurisdiction is no longer governed by binary rules (allowed and not allowed), but becomes a matter of degree, requiring a granular, contextual assessment. It remains the case that such a flexible attitude towards extraterritorial enforcement jurisdiction is not universally shared, and that relevant state practice and expert opinion in favor of the “un-territoriality of data” has a particular Western slant.

A. Introduction

Cyberspace may appear to be the epitome of deterritorialization at work, as digital data are transferred at lightning speed between users and devices across the globe with little concern for territorial boundaries. Such deterritorialization poses a formidable challenge to the international law of jurisdiction, which is ordered around territoriality. In its original Westphalian understanding, territoriality assumes that, in principle, activities can be tethered to one State’s physical territory. When activities become untethered to territory or, given their worldwide effects—tethered to a multitude of territories at the same time—doubts may be cast over the viability of territorial jurisdiction. Indeed, some authors writing in the field of cyberspace have proposed to abandon territoriality as a relevant jurisdictional principle, and instead to use notions such as genuine connection and reasonableness to assess the legality of jurisdictional assertions in cyberspace.¹

Abandoning territoriality is not self-evident, however, as States continue to rely on territoriality to justify their jurisdictional assertions in respect of cyberspace.² States may well be cognizant of the challenges which cyberspace poses to territoriality, but, by and large, they attempt to solve the jurisdictional conundrum by relying on broad interpretations of territoriality³ or on principles of extraterritorial jurisdiction. In the field of prescriptive jurisdiction, such an approach is less controversial than in the field of enforcement jurisdiction. This is because the international law of prescriptive jurisdiction, which governs the geographical reach of a State’s norms, has always given considerable leeway to States to legislate as they see fit, as a corollary of the sovereignty and independence of the State, restrictions upon which cannot be presumed.⁴ Such leeway may be normatively justified to the extent that mere prescription of a norm is far less coercive than actual enforcement of that norm. Prescription does not lead the prescribing State to enter the territory of another State, whereas enforcement may well have this consequence. Indeed, a State does not enter the territory of another State in case it does no more than adopt legislation with an extraterritorial reach or put a person on trial for violation of this legislation.⁵ In contrast, it does enter another State’s territory in case it actually enforces its laws abroad, for example, when it compels compliance with them through coercive measures, such as through searches, arrests and seizures carried out another State’s territory. As such enforcement measures intrude far more deeply into another State’s sphere of territorially delimited sovereignty, a State’s enforcement jurisdiction is considered as strictly limited to its territory.⁶

Thus, we see that in the more liberally regulated field of prescriptive jurisdiction, States, taking their cue from the 19^th century distinction between objective and subjective territoriality, as well as the 20^th century territorial effects doctrine, exercise territorial jurisdiction as soon as cyber activities originate in, are completed in their territory (“ubiquity”),⁷ or have a substantial effect there.⁸ Where territoriality falls short, for that matter, States can still rely on accepted permissive principles of extraterritorial prescriptive jurisdiction, such as nationality, security, and universality.⁹ Cyberspace does not pose structural challenges to the law of prescriptive jurisdiction. The main challenge is rather forensic: given the complex technical nature of cyber systems, how can a genuine (territorial) connection with the regulating State precisely be established?¹⁰

Structural challenges do exist, however, in relation to the international law of enforcement jurisdiction—on which this Article accordingly focuses. While the ubiquity principle in the law of prescriptive jurisdiction gives States flexibility to territorialize the “un-territoriality” of the Internet,¹¹ or to rely on principles of extraterritorial jurisdiction, such flexibility is decidedly restricted under the international law of enforcement jurisdiction, at least as traditionally understood. States can only exercise such jurisdiction outside their territory where the territorial (target) State consents, or where customary or conventional international law confers specific authority for such action. There is no such thing as a ubiquity principle or effects doctrine in the law of enforcement jurisdiction that allows for a broad interpretation of territoriality.¹² This means that States are in principle not allowed to carry out law-enforcement operations, including criminal investigations, on foreign States’ territory. States wishing to obtain custody over a fugitive located abroad need to rely on extradition treaties. States wishing to secure foreign-based evidence need to make use of mutual legal assistance treaties.

This strict approach to extraterritorial enforcement jurisdiction has come under sustained criticism from both experts and States, however.¹³ Discourse and practice increasingly de-emphasize the territoriality of data—its actual location on a server or a device—as a relevant consideration for the valid exercise of enforcement jurisdiction. The Norwegian Supreme Court’s decision in the Tidal ¹⁴ case is instructive in this regard. Tidal is a music streaming company which was accused by Norwegian law-enforcement authorities of artificially inflating listening numbers, thereby defrauding other music artists of their share of subscription revenues. At one point, the authorities searched the companies premises in Norway, downloaded “source codes” from a server in the US, and stored them on a USB stick.¹⁵ They also aimed to extract emails from a Google account belonging to a director based in Norway, while the data were stored on servers in other European countries—the exact location of the data was unknown.¹⁶ The Norwegian Supreme Court did not consider it relevant that the data were located outside Norway, instead basing lawfulness of the enforcement action on the consideration that “[t]he relevant search was carried out by using the access credentials the company had given to” Norwegian law-enforcement authorities, and the action was aimed at a “Norwegian company and its employees present in this country.”¹⁷ According to the Court, “the search will [not] affect another state to an extent that it constitutes a violation of the principle of sovereignty.”¹⁸ Such dynamics may weaken the strict prohibition of extraterritorial enforcement jurisdiction in relation to access to evidence abroad, although practice is certainly not (yet) uniform.

The propounded regulatory shift is informed by the technological features of how and where digital data—which can serve as evidence in criminal proceedings—are stored. Digital evidence of crime, including purely domestic crime, may be scattered all over the globe, be stored, split, copied, mirrored, and distributed “in the cloud” on servers chosen algorithmically by Internet Service Providers, for reasons of ease of user access and cybersecurity. Relevant data may be moved from one jurisdiction to another with the click of a mouse (“data volatility”) and may be stored in different jurisdictions at the same time. The technical features of cloud computing render territorial location a contingent phenomenon. Combined with the sheer mass of digital data in which criminal law-enforcement agencies are potentially interested,¹⁹ they make mutual legal assistance mechanisms appear outdated and impracticable.²⁰ Such impracticability is compounded in case it is unclear where relevant data is exactly stored, denoted as loss of—knowledge—of location. The end-result may be that cybercrimes are not adequately prosecuted, leading to an undesirable impunity gap which may be exploited by cybercriminals.²¹

The problems besetting the processing of requests for mutual legal assistance, especially the delays suffered, have led some States to act unilaterally to secure (likely) foreign-based digital evidence. States tend to make use of essentially two methods: (1) directly accessing data using technological means (direct access via remote techniques, including State “hacking”), or (2) ordering Internet intermediaries, for example, private actors, to produce data under their control—indirect access via production orders. Both methods raise concerns under international law as traditionally conceived, as they bypass State consent and appear to amount to prohibited extraterritorial enforcement jurisdiction. As relevant practice is expanding, however, the prohibition may lose force. New norms of customary international law may possibly crystallize, specifically allocating authority to States to exercise forms of “investigative” jurisdiction²² with an extraterritorial dimension.²³

Analyzing the arguments currently advanced, it is striking that the legitimating and boundary conditions for such jurisdiction are partly derived from notions belonging to the law of prescriptive jurisdiction. Advocates justify extraterritorial enforcement jurisdiction in cyberspace by relying on permissive principles of prescriptive jurisdiction, such as territorial ubiquity and the nationality principle. At the same time, they limit potential jurisdictional overreach by relying on principles of jurisdictional restraint equally borrowed from the law of prescriptive jurisdiction, in particular genuine connection and reasonableness. This double discursive move blurs the lines between the law of prescriptive and enforcement jurisdiction. This process is arguably digitalization’s main transformative effect on the law of jurisdiction.

This article discusses how this transformation unfolds in the context of techniques of direct remote access²⁴ respectively indirect access via production orders.²⁵ The last part zooms out and examines what the on-going dynamics mean for the future trajectory of the customary international law of enforcement jurisdiction in cyberspace. The main normative argument made in this contribution is that, given the nature of cyberspace and the volatility of data, the strict prohibition of extraterritorial enforcement jurisdiction should give way to a rule that allows extraterritorial enforcement action for investigative purposes in principle, but subjects such action to a number of limiting conditions.

B. Direct Remote Access

Faced with the limitations of mutual legal assistance requests, some States are tempted to unilaterally carry out extraterritorial network searches on foreign computers or servers with a view to securing evidence for use in criminal proceedings. Various techniques can be used in this respect. One technique is for law-enforcement authorities to simply seize and search a device, for example a mobile phone, on their territory and remotely access foreign-stored data accessible from it.²⁶ This technique was at issue in the aforementioned Tidal case.²⁷ Another—more extreme—technique is “state hacking,” for example, law-enforcement authorities breaking directly into computers and searching networks outside the State. There is anecdotal evidence that authorities use such techniques to remotely access and control the “dark web,” where illegal activities and transactions take place, such as the exchange of child pornography and the sale of narcotics and weapons.²⁸

Techniques of remote access may have a domestic legal basis,²⁹ although it is a public secret that in some States, law-enforcement agencies carry out remote searches without domestic authorization.³⁰ In any event, there is no clear authorization under international law for such searches. As they amount to investigative acts that are eventually performed on the territory of another State, they appear to fall foul of the prohibition of extraterritorial enforcement jurisdiction, in the absence of ad hoc State consent or treaty arrangements.³¹ Multilateral treaty arrangements explicitly authorizing such acts do not currently exist. Article 19.1 of the Budapest Convention on Cybercrime—the leading multilateral convention on cybercrime, which counts 66 Contracting Parties—empowers States to search and seize stored computer data, but explicitly limits this power to States’ territory.³² Admittedly, Article 32(b) of the same Convention on Cybercrime allows States Parties to “access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system.”³³ However, it is not clear whose consent precisely has to be obtained under this article. It is unlikely to be the service provider, as the provider may not have the lawful authority to disclose the data. More likely, consent has to be obtained from the suspect himself—consent which, for obvious reasons, he is unlikely to give.³⁴ Accordingly, Article 32(b) of the Convention on Cybercrime does not provide a legal basis for extraterritorial network searches.³⁵ Moreover, the provision is only workable in case the location of the data is known; it does not provide a solution in case of loss of knowledge of location.

Multilateral arrangements governing direct remote access are not expected in the short term. While an additional Protocol to the Budapest Convention is currently under negotiation, its draft provisions only strengthen mutual legal assistance procedures, while making limited allowance for extraterritorial production orders.³⁶ The draft text remains silent on direct remote access.

Nevertheless, it has been argued that remote network searches are, or should be authorized under international law, at least under certain circumstances. Various arguments have been advanced in this respect. The most extreme argument is that such searches are not extraterritorial in the first place, because the law-enforcement agencies carrying out the search remain in their own territory.³⁷ This argument is not overly convincing, as the search itself clearly takes place abroad. An arguably more common trope acknowledges that remote searches have an extraterritorial dimension, but that they can be justified on the basis of principles and doctrines of prescriptive jurisdiction. Thus, the Dutch Government explicitly bases investigative enforcement jurisdiction in cyberspace on prescriptive jurisdiction, and relies on the territorial ubiquity principle to justify enforcement jurisdiction.³⁸ On this view, extraterritorial enforcement jurisdiction over data stored abroad is parasitic on the existence of lawful prescriptive jurisdiction. A variation is that extraterritorial enforcement is allowed insofar as the suspect resides on the territory of the enforcing State or holds its nationality.³⁹ Also such a view takes its cue from the law of prescriptive jurisdiction. Indeed, as Jan Spoenle points out, “[t]hese references to the traditional territorial and active personality principles of general criminal jurisdiction might prove useful in reaching a consensus on establishing such a measure.”⁴⁰ A final view has it that enforcement is allowed if the search pertains to serious crime which has a major effect on the State carrying out the search, or to offenses that are internationally considered as particularly grave.⁴¹ Such a view appears to draw on the effects doctrine and the universality principle under the law of prescriptive jurisdiction.

Where advocates of extraterritorial enforcement jurisdiction do not directly rely on permissive principles of prescriptive jurisdiction, they may instead rely, albeit implicitly, on the concept of jurisdictional reasonableness, which was also developed in the law of prescriptive jurisdiction as a tool of restraint to manage overlapping claims of prescriptive jurisdiction.⁴² Reasonableness operates on the basis of a weighting of connections and interests of the various States potentially involved in the matter. Under this rubric, we may find a variety of arguments. For one, it can be considered reasonable for States to carry out remote searches in case of loss of (knowledge of) location.⁴³ Indeed, when the foreign State is not even aware that the data is located on its territory, it cannot be said to have a strong interest in opposing such searches—although it may be a good practice to seek its consent once the location is identified.⁴⁴ For another, it may be reasonable for a State to exercise enforcement jurisdiction where the enforcing State has validly obtained a user’s login credentials, for example through user consent, or via wiretapping,⁴⁵ and this user is based in the territory, such as in the abovementioned Tidal decisions of the Norwegian Supreme Court.

Most commonly, advocates formulate a number of factors that serve as elements of an overall reasonableness-based interest-balancing test that ultimately informs decisions on extraterritorial enforcement. For instance, the explanatory memorandum accompanying the Dutch Act authorizing extraterritorial network searches lists as criteria

The effort which is required to ascertain the identity and location of an automated network, the gravity of the criminal act, the involvement of the Dutch legal order (involvement of Dutch victims or Dutch infrastructure), the nature of the investigative acts—whether data is only copied or also made inaccessible, and the risk for the automated network.⁴⁶

The territorial location of data, devices or networks is only one element of this test, and not the decisive one. Accordingly, this shift to reasonableness, and more generally the importation of notions belonging to the law of prescriptive jurisdiction, has the effect of drastically reducing the importance of strict territoriality as the linchpin of the law of enforcement jurisdiction. Territory is replaced by such flexible notions as effects, connections, and interests.

Nevertheless, donning the lens of a positivist lawyer, one would be hard-pressed to conclude that customary international law already allows for extraterritorial network searches.⁴⁷ Actual State practice remains limited after all. Moreover, it is not always publicly admitted, which disqualifies it as relevant practice for the formation of customary international law. At the same time, (public) foreign protest against such searches is few and far between.⁴⁸ Quite possibly, States prefer not to have their hands tied: Today’s gamekeepers may become tomorrow’s poachers. Accordingly, the practice of extraterritorial network searches is likely to remain in international legal limbo for some time. Nonetheless, this absence of legal certainty is unlikely to deter proactive States from taking measures to prevent the Internet from becoming a safe haven for criminals.⁴⁹

C. Indirect Access—Production Orders

Apart from using direct means to access data held abroad, States also use means of indirect access. States can acquire indirect access to data by ordering Internet intermediaries to produce user data located abroad, for example the subscriber, traffic or content data relating to an email account stored on a foreign server,⁵⁰ possibly backed up with subpoena threats.⁵¹ These Internet intermediaries may be incorporated in the territory, may have a representative there, or simply offer services to users based there.

Also, such production orders appear to be in tension with the prohibition of extraterritorial enforcement jurisdiction, as they bypass the consent of the territorial State. From the perspective of the territorial State, it may not matter much whether the data is directly or indirectly accessed by a foreign State. In both instances, the foreign State appears to carry out investigative measures on another State’s territory.

Still, as such production orders are perceived to not directly intrude on a server abroad, there appears to be substantial international willingness to legally support them, at least within certain bounds. Under the US CLOUD Act, US law-enforcement agencies can now order -US-based Internet intermediaries to disclose information within their possession or control, regardless of location.⁵² Other States, notably Belgium, have gone even further, and have ordered foreign-based Internet intermediaries to produce data to be used as evidence in domestic criminal investigations.⁵³ The European Union is currently mulling its own version of the CLOUD Act, on the basis of a Commission proposal of 2018.⁵⁴ Under the Commission’s proposal, judicial authorities in one EU Member State would be allowed to request (meta-)data from Internet intermediaries, including non-EU-based intermediaries which offer services in the -EU-, regardless of data location.⁵⁵

In the meantime, the Cybercrime Convention Committee has prepared a Second Additional Protocol to the Budapest Convention on Cybercrime, opened for signature in May 2022, which authorizes extraterritorial production orders pertaining to subscriber information.⁵⁶ This Additional Protocol could further clarify the scope of Article 18(1)(b) of the Budapest Convention, which provides that “[e]ach Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to order a service provider offering its services in the territory of the Party to submit subscriber information relating to such services in that service provider’s possession or control.”⁵⁷ The Cybercrime Convention Committee espoused a wide reading of this provision, and posited that it allowed extraterritorial production orders in relation to subscriber information stored abroad and controlled by foreign service providers, as far as those providers offer services in the territory.⁵⁸ However, as a Second Additional Protocol addressing—inter alia—extraterritorial production orders was considered necessary, it is more likely that for some Contracting Parties the liberal interpretation of Article 18(1)(b) of the Budapest Convention was a bridge too far, even in respect of providers offering services in the territory.⁵⁹ Julia Hörnle has observed in this respect that Article 18 only creates a power under the domestic criminal procedures of Contracting Parties to the Convention, and “does not force the receiving state to cede sovereignty to the investigating state,” which is under “no obligation to recognize or enforce the request outside MLA.”⁶⁰

The arguments proffered in favor of the international lawfulness of extraterritorial production orders somewhat mirror the arguments in favor of direct access. In perhaps a slightly more convincing manner, it has been submitted that orders for the production of foreign data are not truly extraterritorial insofar as they are directed at providers over which States have territorial or personal jurisdiction anyway.⁶¹ Such an argument is in fact a replay of an older US argument that discovery orders compelling US-based persons to produce documents they held abroad do not amount to an exercise of extraterritorial enforcement jurisdiction, but are simply territorial in nature.⁶² Somewhat similarly, the Belgian Court of Cassation ruled that ordering a provider (Skype) to produce data located abroad or to perform a wiretap does not amount to an intervention of Belgian law-enforcement authorities abroad, as this only implies a duty of cooperation on the part of the provider.⁶³ A related, but also different argument is that, while production orders may have an extraterritorial dimension, such orders may be justified insofar as their addressees offer services on the territory of the issuing State, and thus participate in economic activities there.⁶⁴ The logic at play here is that, where a State has prescriptive jurisdiction over the activities of Internet intermediaries offering services to users on its territory,⁶⁵ it has ancillary enforcement jurisdiction over data controlled by these intermediaries, regardless of location.⁶⁶ Such an argument again conceives of enforcement jurisdiction as following prescriptive jurisdiction, in particular the effects doctrine. This comes with a twist, however, as the enforcement action does not normally assist criminal proceedings brought against the intermediary itself, but rather against an individual user, or suspect.

Admittedly, advocates of collapsing the distinction between prescription and enforcement are cognizant of the danger of jurisdictional overreach resulting from the application of the effects doctrine to the law of enforcement jurisdiction. Acknowledgement of this danger does not lead them to abandon extraterritorial production orders altogether, but rather to favor the adoption of mitigating principles or safeguards.⁶⁷ Adoption of such principles serves the purpose of legitimating the extraterritorial claim. Strikingly, these principles also draw on the law of prescriptive jurisdiction, in particular the notions of genuine connection⁶⁸ and reasonableness.

Just like in the context of restraints on direct access, these notions may take different forms. Most obviously, States may require that the issuing State notify the State where the data sought is located, or where the intermediary is incorporated.⁶⁹ That said, more elaborate mitigation mechanisms can certainly be envisaged. The European Commission’s proposal for the Regulation for a European Production Order (EPO) offers a good illustration.⁷⁰ First, the scope ratione personae of the proposal is explicitly limited to providers offering services in the EU which have “a substantial connection to the Member State(s).”⁷¹ Second, under the proposal, EPOs for the production of transactional or content data can only be issued for more serious criminal offenses—whereas orders for the production of subscriber and access data can be issued for all offenses.⁷² Third, the EPO proposal features detailed, comity-based provisions on a review procedure where “compliance with the -EPO- would conflict with applicable laws of a third country prohibiting disclosure of the data concerned.”⁷³ Most striking is the multifactor weighting test which a competent EU-based court is required to apply in case of conflicting obligations based on considerations other than fundamental rights or fundamental interests of a third country.⁷⁴ When determining whether to uphold or withdraw the EPO, the court is called on to pay heed to such factors as the third country’s interest, the degree of connection to the relevant States, and the seriousness of the offence.⁷⁵ Such a multi-factor test, weighting multiple interests and connections, is a classic reasonableness test aimed at managing overlapping prescriptive jurisdiction and conflicting legal requirements.⁷⁶ In the field of enforcement jurisdiction, such a test prevents that extraterritorial production orders unduly encroach on third States’ sovereignty and catch providers between a rock and hard place. At the same time, and most importantly, this mechanism of restraint also serves to justify the extraterritoriality of specific production orders.

As demonstrated by recent evolutions in the US, the EU and in the context of the Budapest Convention, there is an international dynamic at play in favor of more liberal rules for extraterritorial production orders, even if hemmed in by a number of jurisdictional restraints. However, this dynamic is far from uncontested. For one thing, the EU Commission proposal has not yet been adopted. In fact, rather drastic amendments have recently been proposed by the European Parliament.⁷⁷ For another, the Second Additional Protocol to the Budapest Convention is unlikely to command the support of all States Parties to the Budapest Convention,⁷⁸ given the wide divergences between the Contracting Parties. Moreover, the Protocol allows for the imposition of additional conditions as well as the possibility to append a reservation, which may not just mitigate but altogether exclude the compulsory nature of extraterritorial production orders.⁷⁹ What is more, even without reservations of their home States, foreign-based addressees of production order have the right not to disclose the relevant data, in which case only mutual legal assistance can be pursued.⁸⁰ If voluntary compliance remains the norm internationally,⁸¹ extraterritorial production orders amount to mere requests which can be disregarded without penalty. They hardly qualify as instances of genuine extraterritorial enforcement jurisdiction.

D. Assessing Current Evolutions

The most eye-catching effect of digitalization on the law of enforcement jurisdiction, as follows from the discussion in the previous sections, is the fading into irrelevance of territoriality. Territoriality has been the bedrock principle of the law of jurisdiction, at least since the Peace of Westphalia. In respect of digital data, however, enforcement jurisdiction no longer follows the geographic location of the evidence sought. The Proposal for a European Production Order cannot be more clear in this respect, where it states that “the data storage location by itself does not suffice in establishing a substantial degree of connection.”⁸² In cyberspace, the territorial location of data at a given time is simply a function of algorithmic decisions of Internet intermediaries offering global cloud computing services. In order to retain their relevance, jurisdictional rules may have to bend to technological realities.⁸³ From a criminal law perspective, maintaining strict territoriality would encourage providers to store data on servers in “safe havens,” a clearly undesirable outcome.⁸⁴ In some circumstances, moreover, the exact location of data may even be unknown, which renders reliance on territoriality a non-starter to begin with.⁸⁵ Insofar as the “physical” location of digital data—on a server—may be entirely fortuitous, and may in fact not be known by the territorial State, that State cannot reasonably invoke its territorial sovereignty as a shield against another State’s jurisdictional claims over such data.

Accordingly, normatively speaking, the better option may be to accept the principled international lawfulness of “extraterritorial” enforcement jurisdiction over digital data, possibly by redefining it as a form of extraterritorial “investigative” jurisdiction in cyberspace.⁸⁶ This would leave intact the traditional prohibition of extraterritorial enforcement jurisdiction in the non-cyber domain, where territorial boundaries are still very much in existence. In the physical realm, there is in any event no indication of State practice and opinio juris in favor of a relaxation of the prohibition. That said, there may be one exception: in the case of human and drugs trafficking on the high seas, we see that some states exercise enforcement jurisdiction over vessels in apparent excess of what is allowed under the UN Convention on the Law of the Sea, a practice which may in due course lead to the crystallization of a new permissive customary norm.⁸⁷ However, given the physical characteristics of the oceans, enforcement jurisdiction at sea has always been subject to a regime different from the general regime governing enforcement jurisdiction on land.

In order to adequately tackle crime in the Internet era, States should be granted more leeway to exercise enforcement—or investigative—jurisdiction over data, regardless of data location. However, to prevent a jurisdictional free-for-all, it is key that that the exercise of extraterritorial enforcement jurisdiction in cyberspace becomes subject to a stringent test weighting all relevant connections and interests in concrete cases. Introducing such a weighting test means that extraterritorial enforcement jurisdiction is no longer governed by binary rules (allowed or not allowed), but becomes a matter of degree, requiring a granular, contextual assessment. What may be acceptable in some circumstances, may be unacceptable in other circumstances.

Such flexibility has long been a characteristic of the law of prescriptive jurisdiction, where lawfulness is assessed in concreto by making use of such malleable concepts as effects, ubiquity, genuine connection, and reasonableness. It appears that these notions are now migrating to the law of enforcement jurisdiction in cyberspace. Thus, digitization is blurring the lines between the rigid law of enforcement jurisdiction and the more flexible law of prescriptive jurisdiction. Critics may perhaps object that such a “post-modern,” case-by-case approach may lack predictability and legal certainty. However, this approach is hardly novel. It has not only been applied for quite some time in the law of prescriptive jurisdiction, but has an even longer pedigree in the conflict of laws—private international law. Especially in the -US-, the flexible notion of comity has been instrumental in solving disputes with cross-border elements.⁸⁸

Nevertheless, this flexible attitude towards extraterritorial enforcement jurisdiction is not universally shared. There is no denying that relevant State practice and expert opinion in favor of the “un-territoriality of data” has a particular Western slant. Moreover, even within the West, contestation continues, as testified by the very limited public State practice in support of direct access, as well as the vicissitudes of the -EPO- and the Second Additional Protocol to the Budapest Convention.⁸⁹ Such contestation may largely pertain to the boundary conditions for the valid exercise of extraterritorial enforcement jurisdiction, but given the close link of these conditions with the principled lawfulness of such jurisdiction, it can hardly be discounted.

States which jealously guard their sovereignty and see an open Internet as a threat rather than a blessing will probably continue to treat digital evidence as any other piece of evidence and subject it to territorial jurisdiction. Such States may require that Internet intermediaries store data within their territory (“data localization”), thereby obviating the need for extraterritorial access. These States are not standing idly by, for that matter. Russia has recently circulated a proposal for a Draft United Nations Convention on Cooperation in Combating Information Crimes, which conspicuously does not provide for extraterritorial production orders.⁹⁰ While this proposal has not yet gained a lot of traction within the UN, the challenge to the Western approach to law-enforcement in cyberspace, and more generally the conceptualization of cyberspace as an open space, is unmistakable.⁹¹

In light of these diverging approaches, universal customary international law regarding such orders is unlikely to crystallize. More likely is the crystallization of customary norms of regional scope, comprising (Western-oriented) liberal democracies with an open Internet. In parallel, such States may mutually adopt bilateral treaties in which they reciprocally recognize the validity of extraterritorial production orders, subject to the necessary safeguards.⁹²