In summary
This article examines the treatment of evidence obtained through cyberattacks in arbitration proceedings conducted under institutional arbitration rules, US law and Brazilian law. We will first discuss the admissibility of illegally obtained evidence under the most commonly adopted institutional arbitration rules, US arbitration law and Brazilian arbitration law. Subsequently, we will draw conclusions on what parties to an arbitration agreement need to consider when choosing the seat of arbitration and where to seek enforcement of the arbitration award to avoid the introduction of illegally obtained evidence into proceedings.
Discussion points
- Cyberattacks and hacking
- Illegally obtained evidence
- Admissibility of evidence in arbitration proceedings
- Recognition and enforcement of arbitration awards based on illegally obtained evidence
Referenced in this article
- Arbitration rules of the AAA, UNCITRAL (2010), PCA, LCIA and ICC
- CIETAC Guidelines on Evidence
- Weeks v United States
- Mapp v Ohio
- Miranda v Arizona
- Silverthorne Lumber Co v United States
- Burdeau v McDowell
- Mosallem v Berenson
Cyberattacks on law firms and legal consultants who assist them have become exponentially more frequent, especially since the onset of covid-19 and the increasing digitalisation of the profession. While in 2020 law firm data breaches affected approximately 46,000 Americans, that figure jumped to over 720,000 in 2021. Furthermore, unlike personal data, the breach of business data may not trigger a data breach report, obscuring law firms’ true exposure to cyberattacks. In fact, experts pointed out that ‘[i]t is an open secret that there are some private investigators who use hacker groups to target opposition in litigation battles.’ Parties and lawyers have had their emails leaked publicly or suddenly entered into evidence in the middle of their trials, exposing their legal strategies and potentially undermining their success. In some cases, these stolen documents came to shape the outcome of the case.
Criminal investigations are not always successful at preventing or curtailing these attacks given the jurisdictional hurdles for investigating transnational cybercrimes. Hackers may launch attacks from any location in the world and hide behind anonymising services. Cybercriminals routinely ‘cross borders, subvert border security regimens, and provide illegal products or services’. While cybercriminals have become increasingly transnational, easily traversing through geographic borders and jurisdictional boundaries, law enforcement has not.
This growing wave of cyberattacks triggers an old but relevant debate for arbitration practitioners: can parties use illegally obtained data in court or arbitration proceedings?
Recently, the issue arose in a dispute between J&F, a Brazilian company, and CA Investment Brazil, the Brazilian subsidiary of a Canadian company. J&F accused CA of orchestrating a cyberattack executed by professional hackers to obtain privileged communications between J&F, its counsel and experts. CA denies responsibility for any cyberattacks J&F suffered. The final award ultimately required J&F to comply with an agreement to sell its stake in Brazilian pulp maker Eldorado to CA. J&F challenged the award in local Brazilian courts claiming the fundamental principle of due process had been compromised, as CA had had unfettered access to J&F’s privileged communications and the arbitrators could not unsee this evidence. A Brazilian national court refused to stay enforcement proceedings, allowing the winning party to enforce the final award. However, the Court has not yet issued a final decision on the application to set aside the award.
This article will first discuss the treatment of illegally obtained evidence in institutional arbitration rules. Then, we will go on to analyse how US arbitration law would treat illegally obtained evidence, and whether its use in the proceedings would eventually impede the recognition or enforcement of the arbitration award in American courts. Subsequently, we will analyse how Brazilian arbitration law would treat illegally obtained evidence, and whether its use would eventually impede the recognition or enforcement of the arbitration award in Brazilian courts. And finally, we will draw conclusions on what parties to an arbitration agreement need to consider when choosing the lex arbitri, the seat of arbitration, and where to seek enforcement of the award to avoid the introduction of illegally obtained evidence into the proceedings.
Institutional rules
Institutional rules play a vital role in arbitration, aiming to guarantee the integrity and efficiency of the proceedings. These rules address key aspects of any given dispute, including the appointment the arbitrators; grounds for challenging their neutrality or impartiality; objections to the existence, validity and scope of the arbitration agreement; joinder of parties and claims; consolidation of two or more arbitrations; emergency measures; admissible evidence; the form and effect of the award; and the confidentiality of the proceedings. However, institutional rules barely address issues of evidence admissibility. When they do, they regulate the issue superficially, attempting to give arbitrators flexibility to tailor their decisions to specific cases. The rules form major arbitral institutions can be grouped into three different approaches.
The first approach is the most detailed and encourages, but does not require, arbitrators to take rules of evidence into account when ruling on the admissibility of a particular piece of evidence. The American Arbitration Association’s Commercial Arbitration Rules determine that ‘[t]he parties may offer such evidence as is relevant and material to the dispute’ but ‘[c]onformity to legal rules of evidence shall not be necessary.’ Further, it allows the arbitrator to ‘determine the admissibility, relevance, and materiality of the evidence offered’, excluding evidence deemed ‘cumulative or irrelevant’. Finally, it directs the arbitrator to ‘take into account applicable principles of legal privilege, such as those involving the confidentiality of communications between a lawyer and client’.
The second approach gives the arbitrators broad power to determine the admissibility of evidence but does not require or reference any rules of evidence. The 2010 UNCITRAL Arbitration Rules clarifies that ‘the arbitral tribunal may conduct the arbitration in such manner as it considers appropriate, provided that the parties are treated with equality and that at an appropriate stage of the proceedings each party is given a reasonable opportunity of presenting its case.’ With regard to the admissibility of evidence, it simply affirms that ‘[t]he arbitral tribunal shall determine the admissibility, relevance, materiality and weight of the evidence offered’, making no reference to which rules or principles should guide their decision. The Permanent Court of Arbitration’s Arbitration Rules also give the tribunal the power to ‘determine the admissibility, relevance, materiality and weight of the evidence offered’, without requiring it to observe a specific set of rules or principles. Finally, under the London Court of International Arbitration’s Arbitration Rules, ‘[t]he Arbitral Tribunal shall have the power . . . to decide whether or not to apply any strict rules of evidence (or any other rules) as to the admissibility, relevance or weight of any material tendered by a party on any issue of fact or expert opinion.’
The third approach completely refrains from establishing any rules when it comes to the admissibility of evidence. The International Chamber of Commerce’s (ICC) Arbitration Rules broadly stipulate that ‘[t]he tribunal will act fairly and impartially and ensure that each party has a reasonable opportunity to present its case’, but do not otherwise stipulate or reference any rules of evidence. Similarly, the China International Economic and Trade Arbitration Commission’s (CIETAC) Rules do not address the admissibility of evidence at all. CIETAC published the Guidelines on Evidence, but these are non-binding for arbitrations conducted under the CIETAC Rules. According to these Guidelines, the tribunal has ‘sole discretion’ to ‘determine the admissibility, relevance, materiality and weight of evidence’. Furthermore, the tribunal may apply the ‘rules on the privilege it considers appropriate’ and ‘decide not to admit certain evidence, particularly confidential communications between a lawyer and his/her client and evidence related to settlement negotiations between the parties.’
In summary, institutional rules seek to guarantee the highest degree of flexibility for arbitrators and parties to tailor the proceedings to their needs. However, they provide little to no guidance on how to treat evidence obtained through illegal or immoral means. Litigants are left in the dark about the extent to which their right to privacy will be safeguarded.
Admissibility of illegally obtained evidence under US law
One of the main advantages of arbitration as a dispute resolution method, in comparison to court litigation, is that the parties are free to pick and choose which rule (or rules) will govern their relationship. In fact, arbitration proceedings frequently involve a patchwork of laws that apply to different aspects of the dispute. One of these laws is the lex arbitri (also called the procedural law or the curial law), the body of national rules that will govern the procedural aspects of the arbitration. When the parties opt for institutional arbitration, the institutional procedural rules will prevail over the non-mandatory provisions of the procedural law. However, as discussed above, institutional rules generally do not establish specific norms for the admissibility of evidence. Therefore, arbitrators may look to the lex arbitri for guidance on whether to admit a piece of evidence offered by one of the parties.
If the parties select US law as the lex arbitri, usually by having the arbitration seated in the United States, then the Federal Arbitration Act (FAA) will supplement any applicable institutional rules. Chapter 1 of the FAA, which contains the general principles applicable to all arbitrations that fall under the FAA, specifies that a court may vacate an award:
- where the award was procured by corruption, fraud or undue means;
- where there was evident partiality or corruption, or both, in the arbitrators;
- where the arbitrators were guilty of misconduct in refusing to postpone the hearing, upon sufficient cause shown, or in refusing to hear evidence pertinent and material to the controversy; or of any other misbehavior by which the rights of any party have been prejudiced; or
- where the arbitrators exceeded their powers, or so imperfectly executed them that a mutual, final and definite award upon the subject matter submitted was not made.
Furthermore, both domestic and convention awards may be denied recognition and enforcement where doing so would violate fundamental public policy of the United States or of the state in which enforcement in sought. However, challenges to procedural aspects of the arbitration generally fail because courts recognise that arbitrators have broad discretion to conduct the arbitration. A court’s inquiry is limited to whether the proceedings were fundamentally fair.
The important question is whether, from a US perspective, admitting evidence obtained through cyberattacks is fundamentally fair. To answer this question, we must investigate how illegally obtained evidence is treated under US law.
The exclusionary rule finds its roots in the Fourth Amendment of the United States Constitution, which protects individuals against unreasonable searches and seizures. The rule was first articulated in 1914, in the landmark case of Weeks v United States, where the Supreme Court held that evidence obtained through an illegal search and seizure should be excluded from federal criminal trials. Subsequently, in Mapp v Ohio, the Supreme Court ruled that the exclusionary rule applies not only to the federal government but also to US state governments. In Miranda v Arizona, the Court established that the exclusionary rule also applies to improperly elicited self-incriminatory statements gathered in violation of the Fifth Amendment, and to evidence gained in situations where the government violated the defendant’s right to counsel.
Finally, in Silverthorne Lumber Co v United States, the Supreme Court held that if evidence that falls within the scope of the exclusionary rule lead law enforcement to other evidence that they would not otherwise have located, then the derivative evidence must also be excluded. The Court later used the metaphor of a poisonous tree, explaining that if the ‘tree’ of the evidence is tainted, then any ‘fruit’ gained must be tainted as well.
However, the Supreme Court subsequently ruled that the exclusionary rule, as well as the fruit of the poisonous tree doctrine, do not apply in civil cases. In Burdeau v McDowell, the Court refused to invoke this protective rule when the unconstitutional searches or seizures were conducted by private persons, even when federal officials proposed to use evidence thus obtained in criminal prosecutions. The majority made the following remarks about the fourth amendment:
Its origin and history dearly show that it was intended to be a restraint on the activities of sovereign authority, and was not intended to be a limitation upon other than governmental agencies ….
In the present case the record clearly shows that no official of the Federal Government had anything to do with the wrongful seizure …. We assume that the petitioner has an unquestionable right of redress against those who illegally and wrongfully took his private property under the circumstances herein disclosed, but with such remedies we are not now concerned.
As explained in Mosallem v Berenson, the common-law rule, still applicable to civil disputes, is that the admissibility of evidence is not affected by the means through which it is obtained. Thus, in the absence of some constitutional, statutory, or decisional authority requiring the suppression of evidence, it will often be admitted even if obtained by wrongful means. In justifying the refusal to apply the common law rule to civil proceedings, courts have stated that ‘[n]one of the reasons given by the courts for excluding in criminal trials the evidence gathered by unreasonable search and seizure applies to civil causes.’ First, ‘[t]he admission of the evidence would not constitute a violation of the privilege against self-incrimination.’ Second, ‘[w]here evidence unlawfully seized is admitted in a criminal trial, there is encouragement of the lawless enforcement of the criminal law, with the government condoning violations of law by officers sworn to observe and enforce it.’ In civil cases, ‘there is no government involved which, on the one hand, seeks to uphold the law, and, on the other, seeks to punish others for not obeying it.’ Finally, the party is not ‘seeking to profit through his wrong by basing his action on the illegally obtained evidence’ when the ‘relief to which plaintiff is entitled is not founded in any way on his wrongful conduct, but on defendant’s alleged wrongful conduct’.
The dissent rightfully pointed out that ‘[i]t is anomalous to enforce opposite rules concerning evidence blighted by the same pollution’ as ‘[t]he unlawful search violates the identical privacy, whether its fruits are used to convict in a criminal prosecution, or to forfeit a personal right in a divorce action.’ It further noted that ‘[t]he question is much the same as posed on a different but related subject: whether to enforce a bargain immoral in nature or prohibited by law.’ However, regardless of the soundness of the reasoning, the common law rule permitting illegally obtained evidence in civil cases remains in force.
Thus, as the introduction of illegally obtained evidence in civil proceedings does not violate a fundamental public policy of the United States, an application to set aside an award based on evidence obtained through a cyberattack would likely fail. Given that evidence obtained through cybertheft is fully admissible in civil proceedings, their use would certainly would not taint an arbitration sufficiently to render it fundamentally unfair.
In conclusion, parties that choose the United States as the seat of arbitration, or that plan to enforce a foreign award in a US local court, should consider that the current state of the law does not protect from having evidence obtained through cyberattacks introduced in the proceedings. Parties should seriously consider tailoring their arbitration agreement to incorporate rules disallowing this type of evidence.
Admissibility of illegally obtained evidence under Brazilian law
If the parties to a commercial agreement decide for the application of Brazilian law as the lex arbitri, they might find an entirely opposing framework when it comes to the admissibility of illegally obtained evidence. Article 21, paragraph 2, of the Brazilian Arbitration Law (BAL) requires that the principle of equality of the parties always be respected in the arbitration proceedings. Article 32 of BAL declares that an award will be null if ‘the principles dealt with in art. 21, §2, hereof are disrespected’. Thus, an award issued under Brazilian procedural law might be nullified if illegally obtained evidence impacted the equality between the parties.
In this respect, the Brazilian Federal Constitution, in article 5, caput, enshrines the fundamental principle of equality, stating that ‘all are equal before the law’. Subsection LVI of the same article provides that ‘evidence obtained by illicit means is inadmissible’. The rule makes no distinction between civil and criminal proceedings. Moreover, the Brazilian Code of Civil Procedure (BCCP) enumerates the duties of the judge and included the duty to direct the process assuring the parties ‘equal treatment’. The BCCP reaffirms that ‘[t]he parties have the right to use all legal means, as well as morally legitimate ones, even if not specified in this Code, to prove the truth of the facts on which the claim or defense is based and to effectively influence the judge’s conviction.’ The combination of these provisions leaves no room for illegally obtained evidence in civil proceedings under Brazilian procedural law. Evidence will be illegal when obtained through a violation of any constitutional rules or legal norms, including those obtained through:
- violation of correspondence, telegraphic and data transmission, and through non-judicially authorised wiretapping of telephone conversations;
- unauthorised entry into the home, except in the case of disaster, to render assistance or judicial determination;
- invasion of privacy, such as phonographic or tape recordings of contacts of a private and confidential nature;
- abuse of power, such as torture; or
- other illicit acts, such as theft, embezzlement and violation of professional secrecy.
The Brazilian Supreme Court went a step further and recognised its own version of the ‘fruit of the poisonous tree’ doctrine, called ‘the theory of illegal evidence by derivation’. Subsequently, the Brazilian Code of Criminal Procedure was amended to incorporate this doctrine, establishing that ‘[e]vidence derived from illicit evidence is inadmissible, except when the causal connection between one and the other is not evident, or when the evidence derived from one can be obtained from a source independent of the first.’
Finally, the Brazilian Supreme Court has already ruled against the application of the principle of proportionality, believing that it is impossible to mitigate the rule in section LVI of article 5 of the Constitution:
From the explicit prohibition of illicit evidence, without distinction as to the crime that is the object of the process, results the prevalence of the guarantee established therein over the interest in the search, at any cost, for the truth in the proceedings: consequently it is impertinent to appeal to the principle of proportionality – in light of foreign theories inadequate to the Brazilian constitutional order – to superimpose, to the constitutional prohibition of the admission of illicit evidence, considerations on the gravity of the criminal infraction object of the investigation or imputation.
Some legal scholars argue that the prohibition of unlawful evidence should not be absolute. According to these scholars, a judge should weigh between the substantive right claimed in a case and the right violated by the unlawful evidence, which may eventually result in the admission of the use of unlawful evidence. A judge may consider a multitude of factors, including the severity of the case, the type of disputed legal relationship, the difficulty in lawfully demonstrating the veracity of the information therein, the prevalence of the right protected by the use of unlawful evidence compared to the violated right and the critical nature of the evidence to convince the judge. For some scholars, a judge may only admit the evidence if certain criteria are met:
- critical: it can only be accepted when it is verified, in the specific case, that there was no other way to demonstrate the allegation of fact that is the subject matter of the unlawful evidence, or even when the other existing method proves to be extremely burdensome or costly for the party, to the point of preventing, in practice, their right to evidence;
- proportionality: the request, that is the subject matter of protection by the unlawful evidence, must prove, in the concrete case, more worthy of protection than the request violated by the unlawful evidence;
- punishability: if the conduct of the party making use of the unlawful evidence is unlawful or illegal, the judge must take the necessary measures so that the conduct is punished under the applicable law (criminal, administrative, civil, etc);
- pro reo: in criminal proceedings, and only in them, unlawful evidence can only be accepted if it will benefit the defendant, and never harm them.
All those factors have also been taken into consideration by a precedent of the São Paulo State Court of Appeals that mitigated the prohibition of unlawful evidence and indicated that certain material collected during an expert examination conducted in the wrong address should, nevertheless, be admitted as evidence considering that it demonstrated the violation of intellectual property rights pertaining to one of the parties.
Regardless of how scholars analyse this issue, given the framework detailed above, Brazilian law theoretically interprets the prohibition against illegally obtained evidence as an intrinsic aspect of the principle of equality between the parties. One would think that a court would likely nullify an arbitration award that failed to observe this rule. That might not be the case. In fact, the Superior Tribunal of Justice – the court afforded jurisdiction to confirm or set aside arbitration awards – has ruled that it will not review whether evidence was improperly admitted into arbitration proceedings as these questions refer to the merits of the case and are, therefore, irrelevant for confirming a foreign ruling.
Furthermore, even if a court was willing to review the issue, the protection against illegally obtained evidence might be in jeopardy depending on how far into the arbitration proceeding the illegality of the means used to obtain the evidence comes to light.
During the course of an arbitration between J&F and CA Investments, an anonymous letter was sent to one of CA’s lawyers, a partner at a Brazilian law firm. The letter contained emails between J&F’s in-house lawyers and external counsel. The lawyer that received the anonymous letter reported it to the parties and ICC tribunal, saying that he had closed it without reading it. J&F later launched an internal investigation into a breach in its cybersecurity and reported it had found malware installed on an external server that had routed emails sent by its counsel to Switzerland. Brazilian local police eventually uncovered illegal spyware on at least 115 J&F email accounts, including those of executives involved in running Eldorado. The hacking allegedly took place from June 2019 to May 2020 and compromised around 70,000 J&F emails, including communications with its arbitration counsel. J&F filed an emergency application to stay the transfer of control of Eldorado from J&F to CA, and an application to set aside the award, arguing that the tribunal failed to act when confronted with the hacking allegations and news of the criminal investigation. CA counters that J&F did not ask the tribunal to take any action and only notified the tribunal and CA that it had been hacked much later in the proceedings. The Second Business and Arbitration Conflicts Court of Sao Paulo dismissed the emergency application, allowing for the transfer of control over Eldorado.
This case unveils a loophole in the protection of litigant’s rights against data theft and cybercrimes. If the investigation does not reach a conclusion about the authorship, method, and extent of the hacking before the tribunal issues an award, tribunals will have no basis to disqualify this evidence from the record as the burden of proof is on the party raising the objection. Similarly, local courts will have no basis to set aside the award, as the burden of proof is on the party seeking to nullify it. Both the tribunal and local courts may, but are in no way obligated, to stay the proceedings until the investigation is concluded. In fact, this might cause a substantial delay in the proceedings, raising the cost and lowering the efficiency of arbitration. It will be up to the parties to tailor their arbitration agreement to address both issues.
Conclusion
It is evident that arbitral institutional rules and the lex arbitri of the United States and Brazil might not provide a sufficient level of protection against the use of stolen evidence in arbitration proceedings. Despite efforts to uphold the principles of due process, fairness and equality between the parties, loopholes and inconsistencies in these legal frameworks undermine their application.
With the ever-increasing incidence of cyberattacks and hacktivism, parties must tailor their arbitration agreement to predict, discourage and combat these practices. The arbitration clause should ideally prohibit parties from offering, and the tribunal from admitting, evidence obtained through cyberattacks.
Furthermore, the parties should weigh benefits against the setbacks in requiring arbitrators to stay the proceedings when there are indicia that the evidence offered by one of the parties has been obtained through data theft. Ideally, the arbitration agreement should allow the tribunal to stay the proceedings for a reasonable period of time if a party offers substantial indicia that opposing party had access to evidence obtained through a cyberattack. This might cause a delay in the proceedings, but it will ensure that both parties’ right to privacy remains intact. It will also guarantee equality between the parties with regard to access to evidence, making sure any award issued is fully recognisable and enforceable in Brazil and the United States.
*The authors gratefully acknowledge the editorial assistance and generous support of Fernanda Pires Merouco of Dentons US LLP in preparation of this article.
Footnotes
——————————————————–
Click Here For The Original Story From This Source.
