Navigating the Dataverse: Privacy, Technology ... - The ICHRP

terrorist”. 144 In Posner’s view, there is a case for issuing many more surveillance warrants,
which would have the principal effect, presumably, of bringing currently warrantless
authorisation (using National Security Letters) within the scope of judicial review.
One important area of data-gathering clearly tends to escape this discussion: the
relevance of this body of law to non-US citizens and non-residents. For the most part,
non-citizens are not covered by many US protections even while in the United States.
The key worry, nevertheless, must concern the government’s extraordinary capacity to
gather personal information about individuals outside the country. Traditionally, such
monitoring has always been subject to fewer controls. Here is how the New York Times
first reported the National Security Agency’s (NSA) programme, from 2001, to monitor
communications inside the United States.
Under the agency’s longstanding rules, the NSA can target for interception phone calls
or e-mail messages on foreign soil, even if the recipients of those communications are
in the United States. Usually, though, the government can only target phones and e-
mail messages in the United States by first obtaining a court order from the Foreign
Intelligence Surveillance Court. 145
Essentially, all communications by non-“US persons” outside the USA are fair game for
communication interception: Posner’s net already exists. (“US persons” include citizens,
permanent residents, and US incorporated legal persons.)
In a similar way, information that US companies gather on foreign nationals abroad (that
is, on non-US persons outside the US), which is often housed in US-based databases, is
subject to fewer controls under US law than information gathered in the US. This poses
intriguing jurisdictional questions over the applicability of foreign law, but the outcome is
that it is generally more difficult for foreign nationals to exercise US courts in cases where
their home courts (or governments) are unwilling or unable to control US companies.
Information that US companies gather on foreign nationals abroad (that is, on
non-US persons outside the US), which is often housed in US-based databases,
is subject to fewer controls under US law than information gathered in the US.
In most countries, people will be reliant on local domestic regulation of the relevant
company (something illustrated in the Yahoo! cases in France and China) to protect
their data from this kind of inquiry by the US government. In practice, however, this
“safeguard” is complicated where the data itself is physically housed in the US. In
addition, it is simply not the case that every country is equally equipped to require
foreign companies not to comply with US government requests of this kind, should they
arise. Controls of this sort only work in any case where companies have significant
assets in the affected country that may be seized in case of non-compliance. In other
words, domestic regulations may have no traction on internet-based companies who
provide services in countries where they have no physical presence at all. 146
144 Judge Richard Posner, “A New Surveillance Act”, Wall Street Journal, February 15, 2006. At: online.wsj.
com/article/SB113996743590074183-search.html.
145 James Risen and Eric Lichtblau, ”Bush Lets U.S. Spy on Callers Without Courts”, The New York Times,
December 16, 2005.
146 Goldsmith and Wu (2006), 59, make the point forcefully: “with few exceptions, governments can use their
coercive powers only within their borders and can control offshore communications only by controlling
local intermediaries, local assets and local persons.” Emphasis in the original.
Navigating the Dataverse: Privacy, Technology, Human Rights 49