L aw enforcement officials in the United States and abroad increasingly seek access to electronic communications, such as emails and social media posts, stored on servers and in data centers located in foreign countries. The architecture of the internet allows technology companies significant flexibility as to the geographic location where they may store collected data. As a result, electronic communications that may be evidence of a crime are not necessarily housed in the same country where the crime occurred. This disconnect has caused governments around the world, including the United States, to seek data stored outside their territorial jurisdictions in the course of law enforcement investigations. Although the SCA generally prohibits certain technology companies from disclosing the contents of electronic communications to third parties, it mandates disclosure to the U.S. government pursuant to a warrant based on probable cause that the communications contain evidence of a crime. In United States v. Microsoft Corp. , the Supreme Court was set to address whether the United States could compel Microsoft to release emails housed in a data center in Ireland through a warrant issued under the SCA. But less than one month after oral argument, Congress passed and the President signed into law the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) as part of the Consolidated Appropriations Act, 2018. The CLOUD Act amends the SCA and requires service providers subject to the SCA to release data in their possession, custody, or control in response to an SCA warrant—regardless of whether the data is located in the United States. A second facet of the CLOUD Act addresses the reciprocal issue of foreign governments' desire to access data in the United States as part of their investigation and prosecution of crimes. Prior to the CLOUD Act, foreign nations seeking data in the United States generally were required to request the assistance of the U.S. government through either procedures established by mutual legal assistance treaties (MLATs) or judicial requests known as letters rogatory. Requests under either instrument are reviewed by U.S. courts before disclosure to the foreign nation is authorized, but U.S. and foreign officials have criticized these processes as inefficient and unable to accommodate the increasing cross-border data demands in the digital era. The CLOUD Act responds to calls for modernization by authorizing the executive branch to conclude a new form of international agreement through which select foreign governments can seek data directly from U.S. technology companies without undergoing individualized review by the U.S. government. Agreements authorized by the CLOUD Act would remove legal restrictions on certain foreign nations' ability to seek data directly from U.S. providers in cases involving "serious crimes" when not targeting U.S. persons, provided that the United States has determined that the foreign nation's laws adequately protect privacy and civil liberties, among other requirements. Restrictions differ depending on the data at issue. . . electronic communication . Because technology companies headquartered in the United States hold a majority of the world's electronic communications on their servers, foreign governments frequently seek data held by U.S. companies. Supporters also argue that the CLOUD Act provides adequate protection for privacy, civil liberties, and human rights.
Law enforcement officials in the United States and abroad increasingly seek access to electronic communications, such as emails and social media posts, stored on servers and in data centers in foreign countries. Because the architecture of the internet allows technology companies to store data at a great distance from the physical location of their customers, electronic communications that could serve as evidence of a crime often are not housed in the same country where the crime occurred. This disconnect has caused governments around the world, including the United States, to seek data stored outside their territorial jurisdictions. In the Clarifying Lawful Overseas Use of Data (CLOUD) Act, Congress enacted one of the first major changes in years to U.S. law governing cross-border access to electronic communications held by private companies.
The CLOUD Act has two major components. The first facet addresses the U.S. government's ability to compel technology companies to disclose the contents of electronic communications stored on the companies' servers and data centers overseas. The Stored Communications Act (SCA) mandates that certain technology companies disclose the contents of electronic communications pursuant to warrants issued by U.S. courts based on probable cause that the communications contain evidence of a crime. But a dispute arose over whether warrants issued under the SCA could compel disclosure of data held outside the territorial jurisdiction of the United States. While the Supreme Court was set to resolve this issue in United States v. Microsoft, the CLOUD Act amended the SCA to require that technology companies provide data in their possession, custody, or control in response to an SCA warrant—regardless of whether the data is located in the United States. On April 17, 2018, the Supreme Court ruled that the change in law mooted the Microsoft case.
The second facet of the CLOUD Act addresses the reciprocal issue of foreign governments' ability to access data in the United States as part of their investigation and prosecution of crimes. Prior to the CLOUD Act, foreign nations seeking data in the United States were required to request the assistance of the U.S. government through either mutual legal assistance treaties (MLATs) or judicial instruments known as letters rogatory. Requests under either instrument are reviewed by U.S. courts before disclosure to the foreign nation can be authorized, but U.S. and foreign officials criticized the processes as inefficient and unable to accommodate the increasing number of data requests in the digital era.
The CLOUD Act responds to calls for modernization by authorizing the executive branch to conclude a new form of international agreement through which select foreign governments can seek data directly from U.S. technology companies without individualized review by the U.S. government. Agreements authorized by the CLOUD Act would remove legal restrictions on certain foreign nations' ability to seek data directly from U.S. providers in cases involving "serious crimes" when not targeting U.S. persons, provided the Executive has determined that the foreign nation's laws adequately protect privacy and civil liberties, among other requirements. While the CLOUD Act conditions approval of covered agreements upon a host of restrictions, commentators debate whether these agreements will provide adequate protections for privacy, human rights, and civil liberties.