Home › Cybercrime Law › Module 9 · Extradition and MLA

Module 9 · International cooperation: extradition, mutual legal assistance and extraterritorial investigative jurisdiction

What this module covers and why it matters. This module covers how one state gets what it needs from another when a cybercrime crosses borders. It sits near the end of the subject's arc from offences to jurisdiction to investigations to cooperation, because a state that has both jurisdiction and investigative powers still cannot act on foreign territory without help. Two consent-based treaty channels answer that need. Extradition brings a wanted person from the foreign state to face prosecution, and mutual legal assistance brings evidence from the foreign state to the investigating one. Both are slow and formal by design, so states increasingly reach for a third route, the unilateral extension of their own investigative measures to data held abroad, which Jessica Shurson calls investigative jurisdiction. For the research essay the live contest is whether that unilateral route is a lawful and rights-respecting evolution or an end-run around the safeguards the treaty channels build in, so the Debate section carries most of the weight here. The core reading is Shurson, and the extradition and mutual assistance mechanics come from the Australian statutes.

Instruments at a glance

Attack plan

Extradition: purpose and framework

Extradition is the formal surrender of a person from the state where they are found to a state that wants to prosecute or punish them. A claim to jurisdiction is worth little without custody of the suspect, so extradition is the mechanism that turns a jurisdictional claim into an effective prosecution. Australia's inbound extradition is governed by the Extradition Act 1988 (Cth), which sets out what counts as an extraditable offence, the stages a request must pass through and the bars that block surrender.

Australia takes a "no evidence" approach to inbound requests. A requesting country supplies a statement of the conduct alleged and the applicable law rather than proof of the allegations, and the Australian court does not test whether the person committed the offence or whether a prima facie case exists (Extradition Act 1988; Global Investigations Review, Australia). The court's task is to check the statutory requirements rather than to try the case.

Double criminality

Double criminality asks whether the conduct is a crime in both states rather than whether the two offences carry the same name or the same label. Run it as a short checklist. First, identify the conduct the requesting state alleges. Second, transpose that conduct to Australia and ask whether it would be an offence here. Third, ask whether the Australian equivalent carries the 12-month threshold. The "equivalent conduct" language allows the court to substitute or translate some factors between the two states, which eases the requesting state's task where the offences are described differently (Extradition Act 1988 s 19(2)(c); Global Investigations Review, Australia). For a cybercrime this rarely bites, because the computer offences in Part 10.7 of the Criminal Code mirror the Budapest offences that most requesting states also enact.

The extradition process

The Extradition Act runs a request through four stages in a fixed order, and each stage must be completed before the next. Read the sequence as a staircase, because the steps run in order and a request that fails at one step never reaches the next (Extradition Act 1988; Global Investigations Review, Australia).

The two ends of the staircase are the political ends and the middle is judicial. Commencement and surrender are executive acts of the Attorney-General, while remand and eligibility are decided by a magistrate. This division matters because the magistrate applies the statutory tests and the Attorney-General exercises a residual discretion on top of them.

The bars to surrender

Nationality is not itself a bar in Australian law. Nothing in the Extradition Act prohibits the surrender of an Australian national, so Australia extradites its own citizens (Extradition Act 1988; Global Investigations Review, Australia). This is a point of divergence between legal traditions that the Debate section takes up, because many civil-law states refuse to surrender their nationals as a matter of constitutional principle.

Mutual legal assistance

Mutual legal assistance is the treaty channel for evidence rather than persons. Where a state needs evidence located abroad it makes a request under a mutual legal assistance treaty to the state where the evidence sits, and that state uses its own coercive powers to gather the evidence and return it. Australia's framework is the Mutual Assistance in Criminal Matters Act 1987 (Cth), which routes requests through the Attorney-General and the Australian Central Authority and lists the forms of assistance available, including taking evidence, producing documents and executing search and seizure (Mutual Assistance in Criminal Matters Act 1987).

The purpose of the mutual assistance channel is to keep cross-border evidence gathering inside a consent-based and rights-respecting frame. A request is reviewed twice, once by the central authority for compliance with domestic standards and once by a judicial authority that issues the order, and the evidence is gathered lawfully in the requested state so that it is admissible in the requesting state's courts (Shurson; Mutual Assistance in Criminal Matters Act 1987). That double review is the source of both the channel's protection and its delay.

The critique of mutual legal assistance

The recurring complaint about mutual assistance is that it is slow, formal and resource-heavy. Because a request may involve many smaller steps within each of the two basic stages the process is lengthy in both time and resources, and a request can take a year or more to complete (Shurson; Stanford Center for Internet and Society). Andrew Keane Woods identifies three trends that undermine the traditional system for digital evidence: the volume of digital evidence is rising, that evidence is disproportionately controlled by foreign service providers, and those providers either cannot or will not respond to foreign requests directly (Shurson, citing Woods).

A second and more structural criticism is that the channel is poorly matched to modern data. In what Shurson calls the minimal extraterritoriality model the data needed for an ordinary domestic investigation sits abroad only because the user happened to choose a foreign service provider, so a French murder investigation into a French suspect for a crime in Paris must route through the mutual assistance process simply because the suspect used a United States email service (Shurson). The location of the data is arbitrary yet the process treats it as decisive. Both the efficiency complaint and this normative complaint have driven states to look past mutual assistance for a faster route.

Unilateral extraterritorial access and its limits

Rather than route every request through mutual assistance, many states now compel service providers that offer services on their territory to hand over data directly, whether or not the data or the provider sits abroad. Because there is no cooperation with the state where the data or provider is located, this is a unilateral exercise of jurisdiction with extraterritorial effect, which Shurson calls investigative jurisdiction (Shurson). States justify it by connecting factors drawn from prescriptive jurisdiction, such as the provider offering or targeting services to users on the territory, seen in the European Union e-Evidence Regulation, the United Kingdom Investigatory Powers Act 2016 and the Belgian Yahoo! and Skype cases (Shurson).

The conceptual problem is that investigative measures such as production orders were traditionally understood as exercises of enforcement jurisdiction, and enforcement jurisdiction is strictly territorial. The classic statement is that a state may not exercise its power in any form in the territory of another state (Shurson, citing the SS Lotus case). A production order sent to a provider abroad stretches that limit because it is an act of compulsory state power rather than a mere request (Shurson). Shurson argues the practice can still be lawful, but only within four limitations.

Shurson argues that most exercises of investigative jurisdiction do not breach the duty of non-intervention, because a production order to a private company copies data rather than deleting or altering it and rarely coerces the foreign state into a policy change (Shurson, citing the Nicaragua and Corfu Channel cases). The fourth limitation does the real work. Comity is a principle of sovereign deference under which a state should sometimes moderate an otherwise lawful exercise of jurisdiction where another state has a stronger connection to the data, and both the United States CLOUD Act and the European Union e-Evidence Regulation build multi-factor comity analyses into their schemes to weigh the competing claims (Shurson).

The three channels compared

Common confusions

Debate

The Debate section carries the research-essay load, so each strand is set out as a contest with the leading voices named. Each closes with questions to test a position rather than settle it.

Should a state extradite its own nationals? The two legal traditions divide on this. Many civil-law states treat the non-extradition of nationals as a settled rule, often written into their constitutions and extradition treaties, on the view that a state owes its citizens a duty of protection and can try them at home under the active personality principle (International Law Commission, aut dedere aut judicare). Australia and other common-law states take the opposite line, extraditing their nationals because nothing in the Extradition Act bars it and because the state best placed to prosecute is usually the state where the harm and the evidence sit (Extradition Act 1988 s 7). The compromise principle is aut dedere aut judicare, either extradite or prosecute, under which a state that refuses to surrender a national assumes an obligation to prosecute them at home instead (International Law Commission). For a footloose cybercrime the tension is sharp, because the suspect may sit in a state that will neither surrender nor effectively prosecute, leaving a real risk of impunity.

• Does a state's duty to protect its nationals outweigh the interest of the state where the harm occurred in trying the offender there?
• If a state refuses to surrender a national, is the home prosecution under aut dedere aut judicare a genuine substitute or a weaker second best?

Should extraterritorial investigative jurisdiction be limited? Shurson argues that the strict territorial limit on enforcement jurisdiction should adapt to global data technologies, so that a state may impose investigative measures on a foreign-based provider that offers services on its territory, subject to her four limitations (Shurson). The orthodox position she is departing from holds that enforcement jurisdiction is strictly territorial and that a state may not exercise its power in any form on another state's territory, so a unilateral production order for foreign-held data is an impermissible extraterritorial act (Shurson, citing the SS Lotus case and Crawford). The middle ground is the significant extraterritoriality model, where the data concerns a national or resident of another state, and there Shurson accepts the sovereignty interest of the other state is engaged and the measure must be moderated or the other state's consent secured. The essay question is where the line between reach and restraint should fall and whether four limitations are enough to hold it.

• Is the SS Lotus territorial limit still an observed norm once states routinely serve production orders on foreign-based providers?
• Which of Shurson's four limitations does the most work, and could any be dropped without collapsing the safeguard?

What is the purpose of mutual legal assistance treaties and are their shortcomings fatal? The purpose of the mutual assistance channel is to gather cross-border evidence with consent and lawfully, so that the evidence respects the sovereignty of the requested state and is admissible in the requesting state's courts (Shurson; Mutual Assistance in Criminal Matters Act 1987). The double review by a central authority and a judicial authority is the source of that protection. The well-known shortcoming is that the same double review makes the process slow, formal and resource-heavy, taking a year or more, and Andrew Keane Woods argues that rising volumes of digital evidence, its control by foreign providers and those providers' unwillingness to respond have overwhelmed the system (Shurson, citing Woods). The contest is whether these are fixable defects of speed and resourcing or a structural mismatch between a location-based treaty channel and un-territorial data.

• Are the delays in the mutual assistance process a resourcing problem that reform can fix or a design problem that the nature of digital evidence makes permanent?
• If the channel's slowness is the price of its safeguards, is that price worth paying for ordinary domestic investigations that touch foreign-held data only by accident?

Are mutual legal assistance treaties more protective of human rights than unilateral access? The protective case for mutual assistance is that its double review builds in checks that a unilateral production order lacks. A judicial authority in the requested state examines the request, and the service provider can raise a conflict of laws, which the European Court of Human Rights has recognised as an important safeguard against abusive surveillance (Shurson, citing Roman Zakharov v Russia). Against that, Shurson notes that a production order is often made without notice to the data subject and that an investigating state may not extend its rights protections to targets abroad, most prominently the United States, so unilateral access can leave the data subject unprotected (Shurson). Her answer is that a state extending investigative jurisdiction extraterritorially must extend its fundamental rights protections accordingly, an obligation courts are beginning to recognise (Shurson, citing the German Federal Constitutional Court). The essay question is whether the mutual assistance channel's safeguards are worth its cost, or whether a well-designed comity analysis inside a unilateral scheme can protect rights just as well and faster.

• Does the service provider's ability to challenge an order replace the protection that a requested state's judicial review supplies, or only part of it?
• If a state must extend its rights protections to foreign data subjects to exercise investigative jurisdiction lawfully, is that condition realistic given that some states decline to do so?

Discussion prompts

1. Explain what a state should weigh before extraditing one of its own nationals to face a cybercrime prosecution abroad, drawing on the civil-law non-extradition rule, the Australian position and the aut dedere aut judicare principle.
2. Set out the double criminality requirement and the four stages of extradition under the Extradition Act 1988, and explain why the process divides between judicial and executive decision-makers.
3. Explain the purpose of mutual legal assistance treaties and identify their well-known shortcomings, and assess whether those shortcomings are defects of speed or a structural mismatch with digital evidence.
4. Using Shurson's account, explain when a state may extend its investigative measures extraterritorially to data held by a foreign-based service provider, and evaluate whether her four limitations are sufficient to protect the sovereignty of other states.
5. Assess whether the mutual legal assistance channel is more protective of human rights than the unilateral extension of investigatory power, and argue which better balances effective investigation against the rights of the data subject.
6. Compare the three cross-border channels of extradition, mutual legal assistance and unilateral investigative jurisdiction, and explain which you would reach for first in an investigation into a cybercrime whose evidence sits with a foreign cloud provider.