Logo TIB AV-Portal Logo TIB AV-Portal

Hello from the Other Side

Video in TIB AV-Portal: Hello from the Other Side

Formal Metadata

Hello from the Other Side
Law Enforcement in the Cloud Age
Title of Series
Part Number
Number of Parts
CC Attribution - ShareAlike 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this license.
Release Date

Content Metadata

Subject Area
How law enforcement agencies (LEA) get access to user data from service providers like Google, Facebook or Microsoft is poorly regulated. Established legal frameworks (Mutual Legal Assistance) are severely outdated and do not adequately protect our human rights. LEA investigations in the cloud are a messy business and currently dominated by pragmatism rather than the rule of law. The talk will highlight issues of the current practices and give an overview over the international reform debate.
goods hypermedia Computer animation Meeting/Interview Lecture/Conference information systems law NET cloud
Facebook's presentation online services services loss Lecture/Conference different communication 3rd Twitter systems
services time forces instant messenger part rules Twitter photos Facebook's message-based Computer animation life sum Right game
processes Lecture/Conference internet law moment sets Right framework rules
photos Facebook's mechanisms means Computer animation framework localization
server words services processes case law bits loss help heck reading
words processes Software visualization case internet breadth Drawing Right game dimension since
Lecture/Conference Office Twitter
time touch life Twitter
proof processes orders help Office dimension Twitter
multiple part Twitter
Meeting/Interview orders instance Twitter
Lecture/Conference time Right
processes time ups
point processes causal communication Content
proof processes causal box 3rd
area proof time Office
point flow scale processes services recognition communication internet civil cloud basis model
photos law loss system call localization
standards time law sets maximal part entire independent photos causal processes Computer animation causal Right game PEAS report
standards standards time maximal independent CAN-bus photos Types causal specific Computer animation causal Lecture/Conference Right PEAS report report
standards decision maximal Stream degree category specific processes terms orders speech Right Free metrics freezing
standards causal civil Content
processes civil dimension
standards civil time share maximal meetings Privacy system call causal Lecture/Conference organization Right form
standards photos processes Computer animation law independent law loss processes Office localization
goods standards law Right maximal Office rules Twitter
Lecture/Conference time lines
man Meeting/Interview time
causal Meeting/Interview Authorization
information causal Lecture/Conference case communication experts sum report theoretical
causal Right threshold
processes Meeting/Interview moment Right help canonical part
Arm Lecture/Conference time Right part
Mutual Lecture/Conference
but it can do you think of the B
good morning everybody and things for waking up early and thanks for being and the interest talk appreciate that and Peter I
work at the system I found what of and and non-party charitable independent thinking and and since we have a lot of talk about and I really wanna talk with you about men different issues and talk to me later if you are interested in what we're doing at the foundational work and what I do for a living and to start with the topic before the presentation is up and if you think about them the online services that uh we could just just told us about so Google Facebook Twitter Tumblr yeah who Instagram Snapchat's whatever you can think of they obviously from thanks that they obviously
some play an important role in our daily lives so imagine how you would communicates through the 3 days of without any of those services some of you
may do that because they're comfortable not using this service but for you to part of us and these services and play Centre Party partner lives so for me it was interesting to look at 1 of the rules of the game for law enforcement to access the data of the services because obviously since they are central part of our life so they play a central part often in crimes and there may be relevant data in Facebook's private messages on Twitter messages or Instagram pictures that are relevant for investigation but at the same time we have an international and dimension because of these services that are hosted outside the sum of EUR outside of Germany yeah so why is that important it well as I told
you that since they they play such a central role will if the rules of the game are outdated the there may be human rights violations so for example if there is a lack of transparency how long force and makes us this data or
im if they are not accountable to what what they're doing so up-to-date as with every other aspect of the Internet up-to-date rules and up-to-date laws that really focus on on central issues extremely relevant
another is that the US is aware of this problem that we treat them I'm working with outdated legal frameworks and outdated and rules so to speak and then updating these right at the moment and it's of course a long process is not like after the uh Republic everything is dominant and set and that M. that striking thing for me is that they're deciding rules for the rest of the world because it's essentially how foreign law enforcement agencies may access data that is stored in the US and they're doing it for the rest of the world and the rest of this set silent so there's very little engage in very very little knowledge knowledge them about this and this issue and thirdly even if you think it that well if it's if it's outdated for law-enforcement that's a good thing because that
means law-enforcement doesn't use it and they don't get access to to our data so easily well you mistaken because what happens is if they are not using these legal frameworks they try our other mechanism so you see a lot
of some data localizations so that Brazil says Facebook if you want to do this in business in our country you have to store the data in them inside our country from another aspect is it and their extraterritorial reach
of loss and I know it's early you past and have your 1st of multi at and I had a little bit too much so it's a territorial reach of loss may sound a bit complicated and it is but it basically means that the USS we don't care whether services as long as the company is headquartered in the yes we have access to the server does matter if it's in Ireland poor somewhat Croatia we have access to it and that means that you have a law that before it was only relevant in your own read you jurisdiction and suddenly you say well it's it's basically legal all over the world so I don't I had and I talked already
already about the bad implications in what is relevant but what the heck are we actually talking about well wonderful name this usually go assistance process I like to words you you you may not like it am but hopefully in the next 20 minutes you understand that it's in a very important phrase of the important work and basically it just means that there might be international crime so someone from country a aided um crime in country B and country the investigates and needs the help of country a to find
this thief or whatever and the this is all this is nothing new to the Internet and there have been international dimensions to crimes since hundreds of was in thousands of years ago and the tricky thing is that these initial legal assistance processes treaties and I just as old as this their decades-old and they were written in that with a mind-set that didn't think about the global network that reaches every corner of the of the nothing could directly connects and everybody so I told you it's a wonderful word and
it's as long as the word is as long as this entire process so we start from the left and go all the way to the right and then we are at the right and we go all the way back to the left I could take the next 10 minutes to explain the process but I think since is not even 11 am and them I really wanted you to understand this year I think it's better not to use this visualization that's the most what beautiful visualization I could think of and that's you so that's the game you all the audience is all Germany and here in my stage and the yes and there's a crime so I need overlaying who wants to be at the far over just you don't even have a new don't need to do anything you don't need to stand out you just need to raise your hand who wants to be but perfectly over there you a length some what did you do you stole I already thought of it so in the very fast and you stole this nice car around downstairs you see this nice
car and so 1 that's awesome he stole it sorry so who wants to be a police officer you there are some police officer so yeah Jennilee's
officer and you saw that he was bragging about still is seeing this car at which was stupid that'd Brecht about it on on Twitter
and so you have a lead you have a Twitter account and you want to look into this to account the who wants to be perhaps for the 1st time in his or her life a judge the German touch you were there will yellow scarf awesome
you the judge so we need 1 more than 1 person and that's the Ministry of Justice so you all people but 1 of you can be an entire Ministry who want to be a ministry you know there are some so Ministry of
Justice judge the and police officer you all German the that's the yes the encumbered but yes I so you still the car you investigating and suddenly there is an international dimension to this crime because there may
be there may be proof on Twitter that he actually stole the car and that that he was Pepsi perhaps not acting alone but there there were was a gang of costing less who might imagine so you good to our wonderful Japs and say well what his proof that I have enough evidence to access this this kind of data she went to court order and to go to the Ministry of Justice and says well we need the help of the yes to solve this crime and the Ministry of Justice as well I have a very nice a process for this is not usually resistance process is very quick so the Ministry
of justice goes to me to be yes I'm I'm multiple parts so goes to the Ministry of Justice the party part of justice to that yes I get the thing to translated it because I don't speak German I only speak english some and I I get this court of and then I give
it to me the US Attorney encode Fournier because Twitter sitting California and then the user turning co-funding into to the court to this difficult and in California of the district where the Twitter headquarters it's and
then it gets close to the FBI and every single stage this court orders it this analyzed that it's corrective it so specific enough and so on and then in the last instance the FBI hands over the court
order to the company to Twitter and then all the way the company produced the data gives it to the FBI the FBI minimizes the data and
sees them if it's relevant then it has it's the District Court then that the user turn of California then of the Department of Justice and Occam's your time I handed back to you you handed back to her she handed back to him and he has stated was was
really quick right because it was like stainless what do you think how long does
this process take well 1 year you're very close very good guess on average it takes 10 months so next
time we need at this stage perhaps I can give you the data it it doesn't really if you think about them Berlin start ups sometimes don't last for 10 months so it seems like in a really anti-predator process and what's what's the problem well it's a slow
process based on really old treaties 2nd thing yes it's this so basically there's no definition outside of the of what a probable causes and you need probable cause it's a legal definition to access data Texas content
and this is a problem to the point that even the and Council of the European Union wrote extensively about this issue that there is
no concept of probable cause inside the EU and it's a very it's a very big struggle for some European Court of a German courts for German judges from to put it to you to agree to this probable cost 3rd thing it's a black
box so once you start this process and you have and hand over the data you don't really know where it's that so and in the last 2 years there was a lot of investigation a lot of questioning and from interviews and we found out that the 1 of the central issues is this probable cost that the and Department of Justice has to constantly will go back to the foreign judge and say well it's it's not enough you don't have enough proof to reach this probable cost
and so we need more proof and then that just goes back to the and to our wonderful police officer and he has to Brive provide more proof and that's that takes a long time and of course
since a lot of companies are sitting in and in California the district courts actually from over some of them have a look too much to do with all the requests because all the companies are sitting in in this area and lastly because
of all the flow model for points is obvious that it doesn't scale in there
in the age of the Internet and the edge of the cloud where we use these kind of services on a on a daily basis this process doesn't work the so
the question that some civil society and the especially US civil society and use companies asked over the last I would say 2 years academics forall follow a lot longer How can we fix the process
how how can we make it scale so that in the long run it's useful again the cops are not trying to suck amended and national governments don't try to circumvent it with data localization and what told you before the extraterritorial reach of loss and 1 of the most concrete proposals how to fix this is called the desk of what's
proposal is very simple to Jennifer the call them a US and law professor and enter what's another
use law professor and what they basically do this they say well if your country has a minimum set of of human rights then we skip the entire US court US Department of Justice and the US um attorney some part of the of the game ends the foreign court of foreign judge over there can
directly access the the company's request the company in the US and ask for for data this this speeds up the process absolutely them at the same time we get rid of of probable cause
them so they tried to and make the minimum human rights standards as high as possible so that you don't need probable cause anymore and at the same time
since I told you these old treaties there really in transparent and accountable to try to fix that too so and to make mandatory reporting by Governments how many requests that did a year from house set successful there were some for which type of types of crime and so on but it's it's not a silver bullet because if you think about this this takes a long time but it's actually
a lot of ice that's look on the specific order order and decide if it's enough to provide the data or not and if you get rid of all that there's not much left so it it's stream certainly streamlines the process but it's not by and by far short
not a silver bullet because if the if you think about how the degree transnationally on minimum human rights standards so there might be cut countries that have very good standards for some for child abuse but they have very poor human rights protection for fever your robbery or money laundering or whatever so suddenly you have to think about well it's not 1 universal human rights uh minimum numerous standard but we actually have to think in terms of some categories of crime and then he and that with the weird metrics ways say well it's OK to work with this kind of country as long as it's not thievery or um religious freeze free speech and if it's OK what about with this country and if it's child abuse but nothing else and it's it is really complicated and again just a more were told you
before the probable cause is really tricky but it's a really high standard so it's actually a very good protection for our content the so with that proposal in that it has been it came up like middle of last year
it has been discussed remarks mainly US civil society and US Department of Justice there was a Senate hearing in the yes the talk about this this issue so the answer is slowly picking
up on the you and they slowly understand all the all the dimensions but the problem is they're talking amongst themselves they're talking with other US companies with
other US civil societies to decide what would be best for the rest of the world and that that doesn't sound like the right process but you can only partly
blame them because you especially European civil society is is fairly silent there there was some a few months a few weeks ago there was a UN conference call and a meeting and I'm in the UK their Privacy International was involved in and other organizations but that was that was a very small share some of the of the European not to speak of international so not you and useful form that this would be really relevant
so yes there might be a lot of problems and then there might be a lot of obstacles to take and we should be very careful to get rid of probable cause and we should be very careful to side what is the minimum human rights standards to access our our data that is stored in the in the yes by US company but at the same time we have the chance to really improve the process because if you get it right if we involve more non US civil society NGO severely involve more academics that I'm not yes then we we really have the chance to make it faster and
more responsive so that the police actually has to use it and cannot governments cannot circumvented by saying well the process is broken we have to do data localization all we have to apply our loss Exeter territorially we can make it more transparent and accountable for them as I said I'm in the
basket what about some proposal there's also the mentioning of of sanctions of independent audits and if you don't comply with the um uh was a proposal and essentially it's if you think about it why in in our scenario where he stole the car and the German police officer investigated why should we play by US law if it's a crime completely inside Germany a completely outside of the
yes so suddenly just because he stored in the picture on Twitter suddenly we have to agree to US law and that doesn't make sense even if it's if it's a good law and for other companies countries uh it might be better protect the human rights and then their own standards for a lot of countries it doesn't make sense so in my opinion it's better to come up with international standards minimum human rights and protection the best human rights protection we can think of them and have a
really international approach instead of just playing by the by the rules of the US decides with that I am come to a full turn and if you think about a wonderful police officer who
waited for 10 months desperately each hoping to get this evidence
and to find the the the real alone responsible guy the lines from adult song Hello from the other side I must have called a thousand times suddenly seem very fit thank you very
much if
the the to do if time for questions or some of the questions yeah the thank you uh you talk was really interesting to me I have
just 1 question about the lack of definition of probable cause because um he said it's a mutual agreement
and I would guess that this indicates that when some US authorities come to a German company that a German court they have to apply legal set up as well how can it be then that there is no definition in Germany or what do the German courts apply
I'm I'm actually no legal experts and information sciences and communication theory from but what I understood from the from the talks with the US lawyers and with the European lawyers them and again what the Council of the European Union Road in their reports on the of course they understand what probable cause means but it's sometimes hard to them quickly adapt this concept and to adjust to a German some uh case what to to Italian kcal too lazy to a case outside the
sum of the sum of the yes because for every case it might you might need a different
evidence from and the the threshold of probable cause might be proven in a different way in and somewhat I mean thank
you when when not less is more I would it would be fair to say that human rights are never gonna talk with the
canonical interests soul I mean to to get this through human rights would have to be more important than economic interests like US interests while that's the thing I am I
don't I don't think there is a lot of them a lot of economic interests from because what happens in the museum usually elicits this process is it is that the ask another country for help in investigation and you don't compensate them for for for this so actually the US has an incentive to update and strictly it's streamlined this process and because at the moment it this this all processes creates a lot of course but that the tricky part is if we don't have a voice in this there is streamlined it just out of efficiency and
in in an economic way but we have a chance to streamline it and at the same time make it more accountable arm
have a strong human rights protection in there but it's only it that it will only happen if we find once if we engage them that the US parts I think there was maybe 1 last question over there
it's OK OK so I think you can pick that kind once for
this very insightful talk and I hope all of us now we know what's the ballots Mutual
legal as a simple scissors also thank you very much and I have had the is