The CLOUD Act, one year on
- By Derek B. Johnson
- Apr 08, 2019
After multiple tries, Congress passed a law in 2018 designed to address how U.S. law enforcement obtains data from foreign-based data centers operated by U.S. firms and how the U.S. government handles data requests from other governments.
Congress, industry and privacy groups wrestled for years about how best to structure a law covering cross-border data requests, but it was a case involving Microsoft that moved the issue to the fore.
In Microsoft v. U.S., the FBI served Microsoft with a warrant in 2013 for data stored in an Irish data center. Microsoft resisted the warrant, arguing that while the data pertained to a U.S. investigation, it existed outside of U.S. jurisdiction. The legal battle was rendered moot by the passage of the Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, which was included in must-pass spending bill.
In an April 5 speech at the Academy of European Law Conference in London, Assistant Attorney General Richard Downing downplayed the importance of the year-old law to U.S. cases and stressed its role in fostering international cooperation.
Downing called the law "a model for international cooperation" that is far superior to the Mutual Legal Assistance Treaties (MLAT) that governed such transactions in the past.
"It offers not simply a solution to the challenge of this moment, but also an aspirational kind of solution," Downing said. "That is, it is a solution aimed at fostering a community of like-minded, rights respecting countries that abide by the rule of law -- where countries can minimize their conflicts of law and advance their mutual interests based on shared values and mutual respect."
Downing lamented a number of "misconceptions" that have followed the CLOUD Act -- namely that it was drafted primarily to serve U.S. interests and that it could make it easier for countries with questionable human rights records to obtain electronic data on their citizens from U.S. providers.
He claimed the impetus for the law came from "our foreign law enforcement partners, who expressed a need for increased speed in obtaining evidence held by U.S. providers," and noted that "the vast majority of major service providers" the CLOUD Act was designed to cover were, by the Justice Department's interpretation, already within the territory and jurisdiction of U.S. law enforcement.
Downing acknowledged that at the time, the Microsoft case had a ripple effect on the behavior of other U.S.-based companies who "stopped complying" with U.S. warrants for overseas data while the case was being considered.
Downing also reiterated assurances that the U.S. would not open up the law's benefits to countries "that do not respect the rule of law and fundamental human rights."
However, on this front, it is virtually impossible to determine whether the fears of critics were valid or misplaced, since the U.S. has yet to establish any bilateral agreements with other nations pursuant to the law. Language in the CLOUD Act gives the executive branch broad discretion to determine whether another country meets the necessary human rights and rule-of-law benchmarks needed to apply for such agreements, with Congress needing a veto-proof majority to reject any the terms of any proposed agreement.
In his speech, Downing said that the law "does not seek to export U.S. legal standards to other countries," arguing that "few, if any, countries today would qualify" for such agreements if the law insisted that they meet U.S. evidentiary standards.
Neema Singh Guliani, senior legislative counsel for the American Civil Liberties Union, said that is precisely the concern groups like the ACLU and Electronic Frontier Foundation have expressed about the CLOUD Act. They argue that the law lowers the evidentiary threshold required for foreign countries to obtain data stored in the U.S. Both groups have called for policymakers to address outstanding cross-border data issues through MLAT reforms to require countries who request data from the U.S. to meet stricter Fourth Amendment warrant standards.
How it fits with GDPR
While the CLOUD Act was created to resolve legal conflicts faced by private companies that may violate one country's laws by complying with the data requests of another, there are signs that the law itself may be creating new conflicts.
Last year, U.S. law firm Reed Smith wrote that companies that comply with the CLOUD Act could find themselves in violation of Article 48 of the European Union's new General Data Protection Regulations (GDPR), which states that any law requiring the transfer of personal data must be based on international agreements, such as an MLAT.
In January, Matthias Artzt and Walter Delacruz, two lawyers charged with aligning data protection policies at Deutsche Bank with international law, expressed similar concerns.
"From the EU perspective, there is significant concern that U.S. authorities might undermine the GDPR requirements set out in Article 48 by utilizing the U.S. CLOUD Act to compel U.S. organizations providing electronic communication services and remote computing services to allow access to certain types of data stored outside the U.S.," the pair wrote.
The EU is in the midst of considering another law, the E-Evidence Act that would govern many of the same cross-border data issues covered under the CLOUD Act. Downing said the EU proposal "does not offer a pathway for non-EU countries to access evidence they need directly from providers located in EU" and "does not lift any legal restrictions under EU or Member State law that could create a conflict of law."
Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.
Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.
Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at firstname.lastname@example.org, or follow him on Twitter @derekdoestech.
Click here for previous articles by Johnson.