This document outlines a presentation on data flows and national security given by Martina Ferracane. It discusses how restrictions on data flows relate to the GATS security exception and assesses how data flows impact national security concerns like cyber espionage, attacks on critical infrastructure, and terrorist threats. The presentation concludes that determining whether data flow restrictions are justified requires analyzing each case based on the security threat picture and alternative technological options.

1. D A TA F L O W S & N A T I O N A L S E C U R I T Y
A C O N C E P T U A L F R A M E W O R K T O A S S E S S
R E S T R I C T I O N S O N D A TA F L O W S
U N D E R G A T S S E C U R I T Y E X C E P T I O N
M A R T I N A F R A N C E S C A F E R R A C A N E
R E S E A R C H F E L L O W A T C A L I F O R N I A I N T E R N A T I O N A L L A W C E N T E R
L U N C H S E M I N A R
8 F E B R U A RY 2 0 1 8

2. O U T L I N E
1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S

3. 1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S
O U T L I N E

4. - WTO: World Trade Organisation
- 95% world trade
- GATS: General Agreement on Trade in Services
- Exceptions: data privacy, national security, etc.
- Dispute Settlement Understanding
B A C K G R O U N D I N F O

5. Restrictions on data flows: do they constitute a
restriction on trade in services?
Yes
No
B A C K G R O U N D I N F O
—> Need for new language
—> GATS applies
What if a country challenged a measure restricting
data flows under the WTO?

6. 1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S
O U T L I N E

7. R E S T R I C T I O N S O N D A TA F L O W S
Source: Ferracane (2017)

8. Source: Digital Trade Estimates Database - ECIPE
R E S T R I C T I O N S O N D A TA F L O W S

9. 1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S
O U T L I N E

10. G A T S A R T. X I V b i s
1. Nothing in this Agreement shall be construed:
(a) to require any Member to furnish any information, the disclosure of which it considers
contrary to its essential security interests; or
(b) to prevent any Member from taking any action which it considers necessary for
the protection of its essential security interests:
(i) relating to the supply of services as carried out directly or indirectly for the
purpose of provisioning a military establishment;
(ii) relating to fissionable and fusionable materials or the materials from which
they are derived;
(iii) taken in time of war or other emergency in international relations; or
(c) to prevent any Member from taking any action in pursuance of its obligations under
the United Nations Charter for the maintenance of international peace and security.
(…)

11. O U T L I N E
1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S N A T I O N A L S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T A T TA C K
5. C O N C L U S I O N S

12. C Y B E R E S P I O N A G E
Source: https://goo.gl/images/5Pa7Pq

13. Source: http://resources.infosecinstitute.com/recognize-phishing-emails/#gref

15. C Y B E R E S P I O N A G E
- Legal analysis:
- International Customary Law (Tallinn Manual 2.0)
- National Laws (in particular, US law —> FISA, Executive Order
12,333 of 1981, but also PRISM and downstream collection)
- In summary, data not might be legally better protected when it is
stored locally in the country of origin
- Technical analysis:
- Harder to access data in certain cases but other forms of access
remain available (phishing, hardware back-doors, etc)

16. O U T L I N E
1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S

17. C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
1. Definition of critical infrastructure
2. Legally: no difference
3. Technically: certain attacks can become more costly
4. Risk of attack might also increase

18. O U T L I N E
1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S

19. T E R R O R I S T T H R E A T S
- Frustrating delay of MLATs
- Copy of data would be enough
- Only threats within the country
- Privacy vs Security

20. O U T L I N E
1. B A C K G R O U N D I N F O
2. R E S T R I C T I O N S O N D A TA F L O W S
3. G A T S S E C U R I T Y E X C E P T I O N
4. D A TA F L O W S & N A T I O N A L S E C U R I T Y
• C Y B E R E S P I O N A G E
• C Y B E R A T TA C K O N C R I T I C A L I N F R A S T R U C T U R E
• T E R R O R I S T T H R E A T S
5. C O N C L U S I O N S

21. C O N C L U S I O N S
- Case-by-case basis
- Scope of the measure (sector, type of data, etc)
- Threat picture of the country
- Alternative technological solutions

22. M A R T I N A F R A N C E S C A F E R R A C A N E
E M A I L : M A R T I N A . F E R R A C A N E @ G M A I L . C O M
THANK YOU!