Presence of Evidence or Its Custodian Corporation in the United States

When evidence of criminal activity is held by a foreign individual, company or entity, the first question is whether the records or items are being stored in the United States, perhaps in a server or storage facility on U.S. territory or through an affiliated U.S. corporation. The “presence” question arises most frequently with records of foreign commercial or communications services. If a foreign company is keeping the needed evidence in a place subject to U.S. laws, it must comply with appropriate federal or state legal demands, including subpoenas, court orders, and search warrants. No international process would be required to obtain the evidence.

The next question is, even if the data is stored outside of the U.S., is it within the control of a foreign entity with a presence in the U.S.? Since the CLOUD Act does not make distinctions between U.S. companies and foreign companies with a physical presence in the U.S., it is possible the CLOUD Act might permit service of the legal process upon a custodian corporation for data it controls stored outside of this country. Of course, the company might raise other jurisdictional or procedural issues in response to the legal process.

Mutual Legal Assistance Treaties (MLATs)

When evidence is located in a foreign country, none of the above techniques are feasible, and admissible evidence is needed, then investigators must seek the help of OIA. The primary method available for obtaining records, or to seize or search items or locations, is through international Mutual Legal Assistance Treaties (MLATs) that establish the steps each country will take to assist the other. The United States has entered into MLATs with countries around the world. Depending on the country, treaty, and relationships, there may be extensive cooperation or merely minimal aid. Usually, to invoke an MLAT’s assistance provisions, the crimes must be serious and prohibited in both countries. There are many countries that do not have MLATs with the U.S., in which case an investigator must look to using Letters Rogatory.

MLAT procedures can require significant time and effort for investigators. The investigator must provide legal and factual justifications for the requested actions, and months, even years, can elapse before a request is accepted and completed.

It is possible to preserve the evidence pending completion of the MLAT process. The Computer Crime and Intellectual Property Section (CCIPS) at the U.S. Department of Justice operates a 24-hour help desk, through which preservation requests can be communicated to the relevant foreign provider or business.^[1]

Searches of locations and seizure of evidence require even more cooperation from authorities in the other country, as well as coordination with U.S. federal law enforcement. While international searches and seizures can be done, they usually take more time and effort to accomplish than records requests.

Letters Rogatory

If the country where the evidence is located does not have an MLAT with the United States, then OIA will need to try other approaches, such as the submission of a formal diplomatic request through a mechanism called a Letter Rogatory. This process is usually lengthier than an MLAT request and can be denied outright by the country receiving the request.

Informal Assistance

On a practical level, informal communication with law enforcement agencies and other authorities in the foreign jurisdiction can lead to the sharing of useful, timely intelligence and investigative support. For example, a police agency within the country may be willing to obtain needed records and share them with law enforcement investigators in the United States. Some countries may not have an MLAT with the United States but may still be willing to assist criminal investigations. Whether to engage in this type of contact outside of an official process is always a strategic decision, weighing the potential benefits to the investigation against the possibility of local authorities intentionally or unintentionally alerting a suspect.

Law enforcement officials may also contact Interpol, an international policing organization with 192 member countries. Interpol works to facilitate police cooperation across international borders. While it does not have the diplomatic or judicial authority of the MLAT process, Interpol can connect investigators with police agencies on the ground in the country where evidence is located. In some instances, support from local law enforcement in the foreign country can help move diplomatic proceedings forward.

No matter what type of evidence is sought from another country, it is possible the other nation will take its own interest in the criminal matter once it has been informed. For example, if a country learns through the MLAT process or an Interpol contact that one of its citizens is suspected of conducting cybercrimes from its soil, that country might initiate its own investigation into the matter or even alert the suspect. To the extent possible, once a request for evidence is made, it is essential to communicate with local authorities (with guidance from OIA), to ensure the U.S. investigation is not compromised, and to gain access to evidence or leads uncovered by local law enforcement. In some instances, local authorities’ instinct to protect their citizens, or a culture of corruption, may lead OIA to advise against local contact.

Egmont Request

Finally, investigators should be aware of the Egmont request, a mechanism available through the Financial Crimes Enforcement Network (FinCEN).^[2] Named for The Egmont Group, an international network of government financial intelligence units, an Egmont request seeks assistance from FinCEN’s counterparts in participating countries to obtain financial information from those countries promptly. The information is supplied in an uncertified format and cannot be used in court, but it can be used to further other investigative steps. If admissible records are desired, investigators can follow up with an MLAT request through OIA.

Suspects Located in Other States and Foreign Countries (Preview)

In Chapter 17 we will learn about the methods for arresting a defendant located in another state or country, as well as how to extradite the defendant to the jurisdiction conducting the investigation and prosecution. The handling of international suspects, in particular, involves some of the same rules and methods as those used to obtain evidence.

• [1] See, the Department of Justice Manual at www.justice.gov/criminal-oia. Also, the CCIPS at the U.S. Departmentof Justice is the point of contact for the “24/7 Network”, a group of approximately 70 member countries that provides investigative collaboration. See, Mysti Degani and Louisa Marion, Making the Most of Your Statutory Electronic Evidence Toolbox, United Stales Attorneys' Bulletin, Vol. 64, No. 3 (May 2016).
• [2] See, FinCEN, The Egmont Group of Financial Intelligence Units, www.fincen.gov/resources/international/egmont-group-financial-intelligence-units.