New US law changes rules for cross-border data requests

March 23, 2018 by Rob Lever
Brad Smith, President and Chief Legal Officer of Microsoft, is seen outside the Supreme Court ahead of arguments in a case over cross-broder warrants for digital evidence, which could be rendered moot by a law enacted by Congress

A measure signed into law Friday by President Donald Trump changes the rules for cross-border law enforcement requests to internet firms and could render moot a long-running court battle between the US government and Microsoft.

The CLOUD Act, inserted in a massive spending bill signed by the president, was designed to streamline the process for seeking digital evidence, but it has been roundly criticized by civil liberties and digital rights activists.

US lawmakers drafted the bill in response to the court battle in which Microsoft refused to turn over the contents of an email account used by a suspected drug trafficker whose data is stored in a cloud computing center in Ireland.

The case was argued earlier this year in the Supreme Court, as attorneys argued that a win for Microsoft could set up a scenario in which police might never be able to access because of how it is scatted across the internet "cloud."

The legislation—Clarifying Lawful Overseas Use of Data—was backed by Microsoft and other major tech companies, which reasoned that it provides a clear legal framework for handing over data both to US authorities and to foreign governments.

Microsoft president Brad Smith said in a blog post this week the measure offers "a modern legal framework for how can access data across borders," while offering privacy protections.

By speeding up the law enforcement process with safeguards, tech firms hoped to stem a trend toward "data localization" in which some countries insist any digital information on their citizens be kept on local soil.

The new law enables the US Justice Department to establish agreements with other countries to speed up data requests, bypassing the existing lengthy diplomatic process, by certifying those countries enforce privacy and civil liberties.

Law enforcement requests for digital evidence can be complicated because of how data is stored in cloud computing centers around the world
Open to abuse?

But some activists said the new law could open the door to increased surveillance and erode protections for human rights activists, journalists and others.

With the new law in place, "US and foreign police will have new mechanisms to seize data across the globe," said David Ruiz of the Electronic Frontier Foundation.

"Your private emails, your online chats, your Facebook, Google, Flickr photos, your Snapchat videos, your private lives online, your moments shared digitally between only those you trust, will be open to foreign law enforcement without a warrant and with few restrictions on using and sharing your information."

Critics said the law lacks adequate safeguards against foreign governments' abuse of human rights standards.

It "fails to impose limits on foreign governments' real-time collection of communications that mirror those that would be required of the US government," said Robyn Greene of the New America Foundation.

"It also does not define what constitutes 'serious crimes' under the bill, and leaves interpretation of that inherently vague concept to the discretion of the foreign government."

Some analysts say the new law will enable the Supreme Court to sidestep a difficult choice—whether to give the US government broad authority to obtain data stored anywhere, or allowing cloud firms to keep data out of reach for law enforcement.

But law professor Jennifer Daskal of American University argues the CLOUD Act is positive for privacy and .

"For the first time, the bill sets up a mechanism for the US government to review what foreign governments do with data once it is turned over," Daskal said in a blog post with Peter Swire of the Georgia Institute of Technology. "This is a privacy win."

The post said that "the status quo is not sustainable" because foreign governments have become frustrated by what they see "as an imperialist attempt to insist that foreign governments obtain a warrant issued by a US judge even for data needed in the investigation of local crimes."

Explore further: Reach of search warrant for emails at issue in appeals case (Update)

Related Stories

Justices seem ready to rule against Microsoft in email case

February 27, 2018

The Supreme Court appeared ready Tuesday to allow the government to force American technology companies to hand over emails and other digital information sought in criminal probes but stored in the internet cloud outside ...

US House passes email privacy bill

April 27, 2016

US lawmakers Wednesday approved a bill to boost privacy protection for email and other electronic communication, closing key loopholes in digital data protection.

Recommended for you

Coffee-based colloids for direct solar absorption

March 22, 2019

Solar energy is one of the most promising resources to help reduce fossil fuel consumption and mitigate greenhouse gas emissions to power a sustainable future. Devices presently in use to convert solar energy into thermal ...

EPA adviser is promoting harmful ideas, scientists say

March 22, 2019

The Trump administration's reliance on industry-funded environmental specialists is again coming under fire, this time by researchers who say that Louis Anthony "Tony" Cox Jr., who leads a key Environmental Protection Agency ...

The taming of the light screw

March 22, 2019

DESY and MPSD scientists have created high-order harmonics from solids with controlled polarization states, taking advantage of both crystal symmetry and attosecond electronic dynamics. The newly demonstrated technique might ...


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.