Introduction
For years, prosecutors and defenders have acted in the confident knowledge that obtaining certain types of important electronic evidence from overseas in time for use at trial has been very difficult. That may now change: the Crime (Overseas Production Orders) Act 2019 (“the Act”) received the Royal Assent on 12 February 2019. The provisions of the Act came into force on 9 October 2019.
The Act enables officers of specified investigative agencies to apply to a Crown Court judge for the production of stored electronic information located or controlled outside the United Kingdom (“UK”), for use in the investigation and prosecution of indictable offences. This power can only be exercised where a designated international co-operation arrangement exists between the UK Government and the government of the country where the electronic information is located or from where it is controlled.
The Rationale Behind the Act
The Act is borne out of two concerns. The first is the recognition that data is increasingly managed, processed or stored by entities located outside the UK. This puts such data beyond the reach of existing domestic court orders, either because such an order cannot be made where the data is not located in the UK, or, where an order can be made, it cannot be served extra-territorially. The second concern is frustration with the mutual legal assistance process (“MLA”), the means by which such evidence is currently obtained. According to the UK Government, it takes an average of 12 months for an MLA request sent from the UK to the United States of America (“USA”) to result in the production of the requested data (assuming it materialises at all). The Act is intended to address the constraints of existing domestic court orders and the limits of MLA in being able to compel the production of evidence from another jurisdiction and being able to obtain it quickly.
Overseas production orders (“OPOs”) represent a paradigm change. Instead of having to rely upon an MLA request being actioned by the authorities in the country where the data is located, an order granted by a UK court will exert jurisdiction over evidence and persons located outside the UK. This jurisdiction can only be asserted, however, where an international co-operation arrangement has been entered into with the government of the country in which the data is located or from where it is controlled. An international co-operation arrangement will be in the form of a treaty with another country which provides for the mutual enforcement of orders for the production of electronic information. In October 2019, such an arrangement was entered into by the UK and the USA (“the UK/USA arrangement”). This is significant given the huge amount of messaging on platforms run by USA tech companies like Facebook and Google.
Making an Application for an OPO
An application for an OPO must be made to a Crown Court judge by an appropriate officer, as defined in section 2 of the Act. The application must specify the international co-operation arrangement by reference to which the application is made and must specify or describe the electronic data in respect of which the order is sought. In common with other types of production orders, applications cannot be made for “excepted” material: by virtue of section 3(3) of the Act, “excepted electronic data” means electronic data that is (a) an item subject to legal privilege, or (b) a personal record which is a confidential personal record. If, however, the application for the OPO is made for the purposes of a terrorist investigation a confidential personal record is not to be treated as “excepted electronic data” and is therefore within the scope of applications and orders. It seems clear therefore that typical everyday electronic messaging falls within the scope of OPOs.
The Conditions for Making an OPO
The Crown Court judge must be satisfied that there are reasonable grounds for believing the following:
(a) the person against whom the order is sought (i.e. the communication service provider which holds or controls the data) operates or is based in a country outside the UK which is party to, or participates in, a designated international co-operation arrangement;
(b) an investigation has been instituted or proceedings commenced in respect of an indictable offence, or the order is sought for the purposes of a terrorist investigation;
(c) the person against whom the order is sought has possession or control of all or part of the electronic data;
(d) all or part of the electronic data is likely to be of substantial value (whether or not by itself) to the investigation or proceedings;
(e) all or part of the electronic data is likely to be relevant evidence in respect of the offence; and
(f) it is in the public interest for all or part of the electronic data to be produced or accessed.
Condition (e) does not apply to terrorist investigations. If the application succeeds, the order must specify the person to whom the electronic data must be produced, or to whom access must be given, and the period by the end of which the data must be produced or access must be given. By virtue of section 5(5) of the Act, the period in question must be seven days beginning with the day on which the order is served, unless it appears to the judge that a longer or shorter period is appropriate in the circumstances. The OPO must be served within 3 months and can be accompanied by a non-disclosure requirement.
Once served, the OPO requires the person named in the order either to produce the data specified or described in the order in a form in which it can be taken away, and which is visible and legible, or to give access to it in a form in which it can be taken away. Section 10(1) of the Act explicitly envisages the data in question being used in criminal proceedings.
The Operation of the Regime
The introduction of OPOs will undoubtedly present challenges. One of the most difficult challenges will be the necessity of engaging with the terms of the international co-operation arrangement between the UK and the USA. Section 9(2) of the Act provides that only the Secretary of State can serve OPOs. Presumably this will be done by the Central Authority in the Home Office. Before the Secretary of State can serve an OPO, he must satisfy himself that to do so would be in accordance with the international co-operation arrangement referred to in the order. This should present an opportunity to bring a legal challenge to the Secretary of State’s decision to serve the order on the grounds that doing so would violate the international co-operation arrangement. For example, Article 7of the UK/USA arrangement provides that appropriate procedures must be in place to ensure that any account that is referred to in the order is used or controlled by the target of the investigation. It could be argued by the company against whom the order has been obtained that, despite the fact the order was made by the Crown Court judge, the account in question is not, in fact, controlled by the target of the investigation, but by someone else.
Challenges by suspects can obviously only be brought if they are aware that the OPO has been made. Applications for OPOs will generally be made ex parte, however. The power provided by section 8 for judges to include non-disclosure requirements in OPOs highlights that suspects will generally not be aware that data related to them has been made the subject of an OPO. Even in the case of journalism, where there is a requirement to serve a notice of application, there is provision to allow judges in certain circumstances to order that journalists need not be notified that their data has been the subject of an application for an OPO: see section 12. There will be a heavy onus on those applying for OPOs to comply with the duty of candour. Once suspects learn of the making of an OPO, which may only be when the relevant data is disclosed by the prosecution, there may be challenges to its admissibility. For example, such challenges could be based on a lack of candour by applicants to issuing judges. The potential for satellite litigation regarding the admissibility of data that has been obtained by way of an OPO is a feature of the regime that cannot be overlooked.
Complying with an OPO could put the communication service provider upon whom it is served in some difficulty. For example, although the communication service provider may be based in the USA, the requested data may be located on a server in a third country. Complying with the OPO by sending the data to a law enforcement agency in the UK could violate the data protection laws of the country where the requested data is stored. This would put the communication service provider in the invidious position of having either to comply with the OPO – and risk being sanctioned by the information commissioner of the country in question (France, for example)– or choose not to comply and being held in contempt of court. Difficult choices may lie ahead. It also remains to be seen how effective enforcement against communication service providers will be, given that failure to comply with an OPO is not a criminal offence, in contrast to a notice issued under section 2(3) of the Criminal Justice Act 1987.
Conclusion
These provisions have the potential to reveal the existence of crucial evidence. Whereas in the past we may have known that defendants were communicating at a key time, but without seeing what they were saying, now it may be possible to obtain such significant messages, both incriminatory and exculpatory. The Act is complex but is based to a large extent upon section 9 and Schedule 1 of the Police and Criminal Evidence Act 1984, so should be familiar. The international cooperation arrangement is an altogether different story. Given the amount of data held overseas which may be of evidential significance, it will not be long before the courts are having to grapple with the intricacies of this new regime.