Hacking by Law Enforcement: Towards a Public International Law of Cyber Espionage?

This article looks at the issues raised by the international aspect of law enforcement hacking in pursuit of anonymous actors on the Internet. It asks whether the competing sovereignty issues discussed above result (or should result) in regulatory regime for cyber espionage under public international law. Broadly, law enforcement hacking describes a method of surveillance that entails the remote access of a computer to install malicious software without the knowledge or permission of the owner/operator. Once installed, malware controls the target computer. Law enforcement hacking is especially handy in the pursuit of targets on the anonymous Internet — defined for the purposes of this paper as those using Tor, a popular and robust privacy software, in order to obscure their location (and other identifying information), and to utilize so-called “hidden” websites on servers whose physical locations are theoretically untraceable. The use of hacking techniques in the pursuit of anonymuzed targets will result in extraterritorial cyber-operations. For instance, over 85% of computers directly connecting to the Tor network are located outside the United States. And since (at least in the context of Tor) each computer’s “unknown location” is virtually indistinguishable from the next, any “anonymized” law enforcement target pursued under this method may be located overseas. The cyber attacks that result will be unilateral. Without knowing the target location before the fact, there is no way to provide notice (or obtain consent from) a host country until after its sovereignty has been encroached. When the host state’s sovereignty is encroached upon, its response depends on the nature and intensity of the encroachment. On the other hand (and as a corollary), states assert jurisdiction over criminal conduct that is initiated overseas, but has a detrimental effect on its territory. This article asks whether the competing sovereignty issues discussed above result (or should result) in a public international law of espionage. Part One discusses (1) the problems posed by anonymizing technologies for law enforcement, (2) the “anonymous” target in its various forms (e.g. the use of unsophisticated “proxy” technologies, and more robust onion-routing technologies), (3) threat model of each anonymizing technology. Part Two describes, in detail, the hacking technologies used by law enforcement to identify, access and control an anonymous target’s computer, highlighting (1) that they are effective in pursuing anonymous actors, (2) that the nature of the technology means that overseas hacking will result and (3) that the extra-territorial activity will be unilateral. Part Three discusses the competing sovereignty issues that international crimes (and extraterritorial law enforcement activity in cyberspace) pose, under the existing lex lata.Part Four discusses how extraterritorial law enforcement activities described in Part Two (1) cannot be regulated using the current institutional devices of public international law (e.g. MLAT) and (2) should not be dealt with using the “private” international law used to regulate traditional espionage (because law enforcement is public). Part Five asks whether the competing sovereignty interests, coupled with the “public” nature of law enforcement, provide a basis for regulating “public” espionage activities (such as law enforcement hacking) in a manner that distinguishes them from traditional (cyber) espionage activities, and what that regulation might look like under the existing lex lata. Part Six raises a number of concerns — e.g. that States will “game” the aforementioned framework by performing “traditional” cyber espionage activities under the auspices of law enforcement, that or third parties will lay out “cyber tripwire” to sabotage other “lawful” cyber operations initiated by law enforcement.