This article gives an account of the legal standards and safeguards that guide and constrain the current design of the UK's digital borders. Based on an empirical engagement with the development of Cerberus – an advanced risk-based analytics platform aimed at the detection of previously ‘unknown’ threats – the article presents a dual argument. On the one hand, it provides an account of the remaining salience and extraterritorial reach of EU law in setting standards for the collection, retention, processing and sharing of Passenger Name Records (PNR) data in the UK. This PNR data is a constitutive component of the digital border. Through the EU-UK Trade and Cooperation Agreement (TCA), the UK is now bound to comply with the rather stringent legal safeguards developed by the CJEU (in Opinion 1/15) on the retention and automated processing of PNR data. Our analysis shows the different channels through which EU law obtains this extraterritorial reach, how compliance can be monitored and enforced, and, crucially, how it has influenced and constrained the technical design of the UK's digital borders – a salient and unexplored phenomenon that we describe as an Infrastructural Brussels Effect. Yet, on the other hand, the article empirically shows that this is not merely a process of norm diffusion and extraterritoriality. Once legal standards become infrastructurally embedded in Cerberus, we witness normative translations and sociotechnical shifts with important legal and political consequences. Legal standards on ‘reasonable suspicion’ and the ‘objective evidence’ of ‘risk’, we argue, are given specific meaning through a logic of relational inference and algorithmic pattern detection (leading to forms of ‘concern by association’). By studying the entanglements between legal norms and material infrastructures – an approach we describe as infra-legalities – these normative effects become visible and contestable, providing a productive site for the sociolegal study of law and algorithmic governance.
Read full abstract