Jurisdiction in Cyberspace: Impact of New Technologies On The Traditional Principles of International Law.

Authored by Arshabh Dev Singh & Neetya Shah, from MNLU Mumbai.

Introduction

One of the bedrock concepts in international law is that of territorial jurisdiction, but the advent of cyberspace has made this concept significantly more complex. Generally, traditional international law has been based on the premise that a State has a defined territorial jurisdiction. But cyberspace is not so constrained. Data can be transferred between several jurisdictions in a matter of seconds, digital evidence can be distributed across servers in different countries, and the physical location of data may not even be known to the service provider holding it. This poses a complex challenge for international law: which State has the authority to access, regulate and enforce its laws in relation to digital evidence? This is especially true when it comes to cybercrime investigations. Where a victim is in India, an alleged perpetrator is in another country, the cloud service provider is incorporated in the USA, and the evidence resides in data centres located in other countries, a purely territorial explanation is not sufficient. The problem, however, is not to abandon territorial jurisdiction, but to determine whether it can be complemented by more flexible principles that can accommodate the realities of cyberspace.

The Territoriality Problem

The concept of territoriality has always provided a fundamental basis for jurisdiction. A State exercises sovereignty over its territory, and its enforcement authorities generally require the consent of another State to exercise coercive powers within that State’s territory. In cyberspace, however, the situation is different, as digital data does not always exist in a fixed geographical location. Cloud computing enables information to be fragmented, duplicated and transferred between servers based on automated processes involving considerations of efficiency, cost and bandwidth. Therefore, the location of a specific piece of evidence may be temporary, unpredictable or even unknown. This creates a fundamental disconnect between law and technology.

Where jurisdiction is based solely on the location of the server, the law may attach disproportionate importance to what is merely an incidental technological fact. A State might have a close connection with the crime, the victim and the infrastructure affected by the crime, but have no meaningful connection to the country in which the server is located. Mutual legal assistance treaties (MLATs) are also a significant constraint in this regard. These mechanisms were designed for a world in which evidence was predominantly physical and geographically identifiable. A request for cross-border evidence, for example, can take much longer to process than the investigation itself, while digital evidence can be rapidly moved, deleted or encrypted. The consequence is a growing tension between the need for effective law enforcement and the principle of State sovereignty.

The Difference Between Prescriptive Jurisdiction and Enforcement Jurisdiction

The distinction between prescriptive jurisdiction and enforcement jurisdiction is important in understanding the jurisdictional challenges posed by cyberspace. Prescriptive jurisdiction refers to the authority of a State to prescribe rules and regulate particular conduct through legislation. Enforcement jurisdiction, on the other hand, concerns the authority of a State to enforce its laws through governmental powers, such as conducting searches, making seizures and effecting arrests. This distinction is especially significant in the cyber context. International law may allow a State to regulate conduct occurring partly outside its territory where such conduct produces significant effects within its territory. This is reflected in the ubiquity principle, which recognises territorial jurisdiction where various components of an act occur across multiple territories. Prescriptive jurisdiction does not, however, automatically give rise to a right to exercise enforcement jurisdiction overseas. The traditional rule is that the consent of the State in which the enforcement action is to be undertaken, or another recognised basis under international law, is required for enforcement action within another State's territory. States therefore depend on mechanisms such as extradition treaties and mutual legal assistance agreements to secure persons and obtain evidence located in other countries. This becomes particularly complex in cyberspace, where investigators may have the technical ability to access foreign data without physically entering foreign territory.

This leads to a difficult question: When can a search be considered “extraterritorial” if the investigator is physically present in their own State but the computer system being accessed is located in another State?

Direct Remote Access and the Sovereignty Challenge

Direct remote access is one approach adopted by some States. It enables investigators to gain access to foreign-stored data without relying upon traditional inter-State mechanisms of cooperation. The least controversial scenario could arise where a device is lawfully seized within a State and is subsequently used to access information stored outside that State's borders. The Norwegian Supreme Court's judgment in Tidal Music AS v. Public Prosecution Authority is important in this regard, as the Court considered whether Norwegian police could download digital material stored abroad from terminals located at the company's Norwegian office. More controversial is state hacking, where investigators use malware or other technological means to access computer systems located abroad. There remains disagreement regarding the international legality of unauthorised cross-border hacking by State authorities. The Budapest Convention on Cybercrime provides an important framework for international cooperation, but does not establish a blanket authorisation for unilateral extraterritorial hacking. Under Article 19, searches and seizures are generally subject to territorial limitations, while Article 32 permits certain forms of trans-border access under specified conditions, including lawful consent. The issue is whether technological capability should translate into legal authority.

Indirect Access: The Regulation of Service Providers

Instead of directly accessing a foreign server, authorities issue a production order to a service provider requiring it to produce information within its possession, custody or control. This is becoming increasingly significant in the era of digital platforms and cloud service providers, which may control access to information regardless of where that information is physically stored. One example is the CLOUD Act in the United States. The law imposes legal obligations on covered providers with respect to data within their possession, custody or control, even where that data is located outside the United States.

The U.S. Department of Justice's CLOUD Act Resources provide official materials concerning the legislation and its international application. The Department of Justice explains that the CLOUD Act was enacted in 2018 in part to facilitate access to electronic information held by U.S.-based global providers in investigations of serious crime.

The European Union has also developed a provider-oriented approach through the e-Evidence Regulation — Regulation (EU) 2023/1543. The Regulation establishes European Production Orders and European Preservation Orders for electronic evidence and permits certain orders to be directed towards service providers regardless of the location of the data. Indirect access is generally considered less intrusive than unilateral hacking because the order is directed towards an entity that is subject to the jurisdiction of the issuing State. However, it also raises important legal concerns. A State may, in effect, obtain foreign-stored data without the consent of the territorial State. This can give rise to concerns relating to sovereignty, privacy and international comity.

Towards a New Standard: Reasonableness

The challenges associated with direct and indirect access suggest that a rigid territorial approach may no longer be sufficient. One principle proposed as a possible solution is reasonableness. Under this approach, the legality of a cross-border investigative measure would be determined on a case-by-case basis. Relevant considerations may include the nature and seriousness of the alleged offence, the lawfulness of the investigators' access to the data, whether the location of the data is genuinely unknown, and whether realistic alternative means of obtaining the data exist, such as through mutual legal assistance. The flexibility of reasonableness is one of its principal advantages. It recognises that not all forms of remote access interfere with foreign sovereignty to the same degree. Flexibility, however, should not become unlimited discretion. A reasonableness test must therefore be applied through clear and identifiable standards.

The Genuine Connection Test

A second approach is to determine whether there is a genuine connection between the State seeking access and the investigation.

Factors that could be considered include the nationality of the suspect, the location of the victim, the location of relevant infrastructure, and the territorial effects of the alleged crime. The purpose of this approach is to prevent excessive or overbroad assertions of jurisdiction. The mere fact that investigators are technically capable of accessing data should not be sufficient. There should be a substantial relationship between the State exercising jurisdiction and the investigation itself. The approach therefore shifts the discussion from Where is the server? to the more substantive question: Why does this State have a legitimate interest in accessing this evidence? This also requires the competing interests of States to be considered and seeks to promote international comity.

Interest-Balancing

Multiple States may be involved in a single cyber investigation. One State may have jurisdiction because of the victim's location, another because of the suspect's nationality, another because of the incorporation of the service provider, and another because the relevant physical infrastructure is located within its territory.

Interest-balancing acknowledges these overlapping interests and requires them to be considered collectively.

Relevant factors include law-enforcement interests, State sovereignty, individual rights and the burden imposed on intermediaries. The approach is based on the concept of international comity and seeks to promote cooperation over unilateral action.

The concept of interest-balancing may ultimately provide a useful conceptual approach to cyberspace, where traditional territorial boundaries are increasingly difficult to apply to competing jurisdictional claims.

Conclusion

Territorial sovereignty remains an important principle in cyberspace. However, cyberspace has exposed the shortcomings of assuming that jurisdiction can be established solely through physical presence. The location of data is often unknown, may change frequently, or may be legally incidental as a result of cloud computing, distributed infrastructure and cross-border digital evidence. Unrestricted enforcement, on the other hand, could compromise the sovereignty of other States and threaten individual rights. However, the future of cyber jurisdiction is not to be found at either of these extremes. There is a need for efficient mechanisms to investigate cybercrime; however, these mechanisms must operate in accordance with the principles of sovereignty, proportionality and legality. Direct remote access, particularly unilateral hacking, poses greater concerns for State sovereignty, while indirect access through service providers represents a developing alternative. There is therefore a possible way forward through the emerging principles of reasonableness, genuine connection and interest-balancing. These principles propose a shift from a purely territorial approach towards a multi-faceted approach to jurisdiction, based not only on geography but also on the nationality of victims, the location of relevant infrastructure, the role of service providers, the effects of the conduct and the competing interests of States.