Mysti Degani

U.S. Department of Justice

 Offenders (and their devices) are abroad

 Domestic offenders use service providers (email, social

media, web hosting) located abroad

 Proceeds are sent to banks or people abroad

 Preservation requests are critical because international
assistance procedures are typically slow

 Electronic evidence is fragile

 Deleted easily – intentionally or accidentally
 Providers may retain only for a certain period of time

INVESTIGATORS MUST ACT QUICKLY

TO PRESERVE DIGITAL EVIDENCE
 If you make a preservation request with the assistance of
U.S. authorities, U.S. law requires:
 Initial preservation of 90 days; extended for 90 days upon request
 Some providers will preserve longer for international requests

 Preservation is only of data that already exists

 NOT prospective!
 When evidence is needed immediately to avoid risk of death or
serious bodily harm, consider an emergency disclosure request

 Can be done via 24/7 Network

 In some cases, may be able to request disclosure directly from the
provider, especially non-content information

 Identify nature of emergency, link between information sought

and the emergency

 In the U.S., it is the provider’s decision whether to disclose

 Whether this is an option will depend on the law of the
country in which the provider is located and/or their
policies
 U.S. law only allows providers to disclose non-content directly to
foreign governments
 U.S. law does not require providers to disclose directly to foreign
governments; any compulsion would have to come from the foreign
authority

 Providers who are willing to disclose directly may choose to

disclose to only certain countries
 Many providers now have web-based portals for the submission of
requests for disclosure of data

 Review the law enforcement guidelines/privacy policy of the

provider
 What information they collect
 Their policies and requirements for responding to data requests
 Advantages
 Faster and more flexible than formal assistance

 Disadvantages
 Assistance available may be limited by law or practical problems
 May be difficult to obtain without pre-existing contacts
 Potential issues with using evidence obtained in a proceeding
 Your embassy in the foreign country in which the data is
located can be an excellent place to start
 Likely to be familiar with laws of that country
 Likely to have contacts with the foreign government who may be
able to assist

 Other contacts within the country can also be helpful resources

 Types
 Mutual Legal Assistance Treaty requests
 Requests under multilateral treaties (Budapest Convention on
Cybercrime)
 Letters rogatory

 Advantages
 Formal process
 Obligation to respond if a treaty exists

 Disadvantages
 Slow
 Subject to resource/expertise limits of foreign government
 May be subject to dual criminality requirement
 Basis of request (name of treaty, comity)
 Facts relating to the investigation
 Should establish link between data/account and investigation and
explain why this information will be helpful
 Identifying information for target(s)
 Specific offenses under investigation
 Assistance requested
 Specific information sought
 Any special procedures to be followed/documentation to be obtained
 Whether confidentiality should be maintained
 Reach out to the central authority in your country early in the process
 Templates
 Guidance for the legal regime in the receiving country, which can affect
how you draft your request
 Other intel

 Leave LOTS of time

 Make sure you provide adequate facts/detail and sourcing – otherwise

delay will result as the foreign country asks you for more information
 Specify if you need confidentiality
 This will permit the foreign authority to take the steps necessary/permitted
under their law to ensure the target of the investigation is not notified

 Always include time zones when specifying the time/date for the
information you want

 Always specify any particular documents that you need

 Certificates of authenticity
 Official records (i.e. court orders) associated with the execution of the request
 Formal agreement between law enforcement in two
countries to work together on an investigation

 May make it possible to obtain additional

assistance/evidence from partners

 Not available in all cases