One of the many recommendations in the President’s Review Group report on the NSA surveillance programs released last month was for the review of MLATs, or Mutual Legal Assistance Treaties. This was the second time that MLATs made the news in December: at the beginning of the month, eight major internet companies issued a series of principles for reforming government surveillance that including improving the MLAT system. Clearly MLATs are an issue, but what does this four-letter word mean, and why are they so desperately in need of reform?
What is an MLAT?
MLATs are formal agreements between countries that create international legal obligations to assist one another in criminal investigations and prosecutions. Law enforcement officers or prosecutors use them when they need help to obtain evidence held in another country.
Generally speaking, an MLAT request works as follows: a police officer or prosecutor in Country A works with their department of justice to make a formal, written request for assistance to the justice department of Country B. Country B’s justice department then refers that request to their local police, and the local police obtain any necessary court orders to retrieve the requested evidence. The evidence is then sent to Country B’s department of justice, which sends it on to Country A.
It’s a very formal process and involves several layers of bureaucracy in both the requesting country (Country A) and the requested country (Country B).
Why does this matter to my emails?
Many of the internet companies that provide email and social media accounts have servers in the US (including Google, Facebook, Yahoo!, and Twitter). This means that even if you’re an international user, access to your data is likely controlled by U.S. law. Foreign law enforcement cannot directly get a U.S. court order or subpoena to obtain user data — instead, they must go through the MLAT process. Effectively, this means that if a foreign country wants your data those data are in the U.S., they have to have the FBI obtain a court order on their behalf.
So, what is wrong with MLAT?
The MLAT system was designed for the 20th century and struggles to cope with the pace and complexity of data transfers across multiple jurisdictions. It can take a long time for law enforcement to be able to access evidence held online — the President’s Review Group says the average is 10 months — and sometimes in the order of years. There is uncertainty about when data can be shared, with whom, and on what terms, and it all happens with very little transparency or oversight. This is a problem for law enforcement who want to catch criminals, but also for users who are concerned about protecting their privacy and other important rights.
Because of these problems with the system, law enforcement agencies are often inclined to seek the information they need through other, informal methods. After all, why would anyone go through layers of bureaucracy and months of waiting when they can just call a friend in another country? And when things are done through informal processes, there is usually little to no transparency or accountability.
How can it be fixed?
The President’s Review Group and the internet companies have both called for improvements to the MLAT system. The Review Group Report makes some specific recommendations, such as increasing the Department of Justice’s resources, creating an online submission form for MLATs, and promoting the use of MLATs globally. That would be a good start, but there are more things that can and should be done, particularly in order to safeguard individuals’ privacy and other human rights.
Here are four small, practical things the Obama Administration could do right now that would dramatically improve the MLAT system:
- Commit to providing online data within a month of receiving an MLAT request;
- Publish regular government transparency reports, including breakdowns of number of requests received from different countries, the response provided, and the crimes to which the requests relate;
- In consultation with the internet companies, provide clear, public guidance on what information can only be obtained through an MLAT and what procedures; and safeguards are in place for information that is obtained outside of the MLAT system
- Establish clear, publicly-available procedures and documentation standards for the handling of emergency cases.
One key aspect of all of these reforms is transparency. Better and more accessible information about the various laws and the way in which they operate would assist government and company officials to make fast, well-informed, and consistent decisions. It would also enable users to hold governments and companies to account by providing the information that is necessary for users to challenge decisions about the handling of their data. More and more companies have begun to publish transparency reports that include basic information about MLAT requests and company policies. However, achieving greater transparency requires commitment from government as well as companies.
As part of the push for transparency, last year Access filed Freedom of Information Act requests with the U.S. Department of Justice and the FBI. The FOIA requests sought “any and all information pertaining to or documenting requests made by foreign countries through Mutual Legal Assistance treaties… with the U.S. that sought… electronic information.”
While we were initially told there were no responsive records to our request, the Department of Justice Office of Information Policy ruled positively on our appeal in late December, requiring the DoJ’s Criminal Division to do another search for this information. We are still waiting on the outcome of this revised search.
There are some legitimate operational requirements that can necessitate keeping some aspects of specific MLAT requests confidential. However, most information about MLAT requests can and should be made publicly available. This is an opportunity for the Obama administration to step up to the challenge of beginning to make the MLAT system more transparent. Rather than giving a blanket refusal to hand over any information, we hope that the DOJ begins to allow the light to be shone on this system.