U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

98–827 PDF 2016

INTERNATIONAL CONFLICTS OF LAW AND THEIR 

IMPLICATIONS FOR CROSS BORDER DATA 

REQUESTS BY LAW ENFORCEMENT 

HEARING 

BEFORE THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

FEBRUARY 25, 2016 

Serial No. 114–84 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 
(II) 

COMMITTEE ON THE JUDICIARY 

BOB GOODLATTE, Virginia, Chairman 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

LAMAR S. SMITH, Texas 

STEVE CHABOT, Ohio 

DARRELL E. ISSA, California 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TOM MARINO, Pennsylvania 

TREY GOWDY, South Carolina 

RAU ́ L LABRADOR, Idaho 

BLAKE FARENTHOLD, Texas 

DOUG COLLINS, Georgia 

RON DeSANTIS, Florida 

MIMI WALTERS, California 

KEN BUCK, Colorado 

JOHN RATCLIFFE, Texas 

DAVE TROTT, Michigan 

MIKE BISHOP, Michigan 

JOHN CONYERS, JR., Michigan 

JERROLD NADLER, New York 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO R. PIERLUISI, Puerto Rico 

JUDY CHU, California 

TED DEUTCH, Florida 

LUIS V. GUTIERREZ, Illinois 

KAREN BASS, California 

CEDRIC RICHMOND, Louisiana 

SUZAN DelBENE, Washington 

HAKEEM JEFFRIES, New York 

DAVID N. CICILLINE, Rhode Island 

SCOTT PETERS, California 

SHELLEY HUSBAND, Chief of Staff & General Counsel 

PERRY APELBAUM, 
(III) 

C O N T E N T S 

FEBRUARY 25, 2016 

Page 

OPENING STATEMENTS 

The Honorable Bob Goodlatte, a Representative in Congress from the State 

of Virginia, and Chairman, Committee on the Judiciary ................................. 1 

The Honorable John Conyers, Jr., a Representative in Congress from the 

State of Michigan, and Ranking Member, Committee on the Judiciary ......... 3 

WITNESSES 

David Bitkower, Principal Deputy Assistant Attorney General United States 

Department of Justice 

Oral Testimony ..................................................................................................... 11 

Prepared Statement ............................................................................................. 14 

Brad Smith, President and Chief Legal Officer, Microsoft Corporation 

Oral Testimony ..................................................................................................... 57 

Prepared Statement ............................................................................................. 60 

The Honorable Michael Chertoff, Co-Founder and Executive Chairman, The 

Chertoff Group 

Oral Testimony ..................................................................................................... 72 

Prepared Statement ............................................................................................. 74 

The Honorable David S. Kris, former Assistant Attorney General for National 

Security, United States Department of Justice 

Oral Testimony ..................................................................................................... 80 

Prepared Statement ............................................................................................. 82 

Jennifer Daskal, Assistant Professor, American University Washington College of Law 

Oral Testimony ..................................................................................................... 84 

Prepared Statement ............................................................................................. 86 

LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING 

Prepared Statement of the Honorable Sheila Jackson Lee, a Representative 

in Congress from the State of Texas, and Member, Committee on the 

Judiciary ............................................................................................................... 5 

Material submitted by the Honorable Sheila Jackson Lee, a Representative 

in Congress from the State of Texas, and Member, Committee on the 

Judiciary ............................................................................................................... 109 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD

Questions for the Record submitted to David Bitkower, Principal Deputy 

Assistant Attorney General United States Department of Justice .................. 128 

Response to Questions for the Record from Brad Smith, President and Chief 

Legal Officer, Microsoft Corporation .................................................................. 130 

Questions for the Record submitted to the Honorable Michael Chertoff, CoFounder and Executive Chairman, The Chertoff Group ................................... 138 
Page

IV 

Response to Questions for the Record from the Honorable David S. Kris, 

former Assistant Attorney General for National Security, United States 

Department of Justice ......................................................................................... 140 

Response to Questions for the Record from Jennifer Daskal, Assistant Professor, American University Washington College of Law ................................. 143 
(1) 

INTERNATIONAL CONFLICTS OF LAW AND 

THEIR IMPLICATIONS FOR CROSS BORDER 

DATA REQUESTS BY LAW ENFORCEMENT 

THURSDAY, FEBRUARY 25, 2016 

HOUSE OF REPRESENTATIVES

COMMITTEE ON THE JUDICIARY

Washington, DC. 

The Committee met, pursuant to call, at 10 a.m., in room 2141, 

Rayburn House Office Building, the Honorable Bob Goodlatte, 

(Chairman of the Committee) presiding. 

Present: Representatives Goodlatte, Chabot, Issa, King, Jordan, 

Poe, Marino, Gowdy, Collins, DeSantis, Walters, Buck, Ratcliffe, 

Bishop, Conyers, Lofgren, Johnson, Chu, DelBene, Jeffries, and Peters. 

Staff Present: Shelley Husband, Chief of Staff & General Counsel; Branden Ritchie, Deputy Chief of Staff & Chief Counsel; 

Zachary Somers, Parliamentarian & General Counsel; Kelsey Williams, Clerk; Jason Herring, Counsel, Subcommittee on Crime, Terrorism, Homeland Security, and Investigations; (Minority) Perry 

Apelbaum, Minority Staff Director & Chief Counsel; Danielle 

Brown, Parliamentarian & Chief Legislative Counsel; Aaron Hiller, 

Chief Oversight Counsel; Joe Graupensperger, Chief Counsel, Subcommittee on Crime, Terrorism, Homeland Security, and Investigations; and Veronica Eligan, Professional Staff Member. 

Mr. GOODLATTE. Good morning. The Judiciary Committee will 

come to order, and without objection, the Chair is authorized to declare recesses of the Committee at any time. 

We welcome everyone to this morning’s hearing on ‘‘International 

Conflicts of Law and Their Implications for Cross-Border Data Requests by Law Enforcement,’’ and I will begin by recognizing myself for an opening statement. 

Today’s hearing will examine international conflicts of law and 

how these conflicts impact law enforcement access to data both 

here and abroad. This is an extremely important issue that affects 

individuals, technology companies, law enforcement, and the economy. In the digital age, where the Internet knows no boundaries, 

U.S. technology companies have flourished internationally and provide services to customers and subscribers around the world, but 

there is a growing tension between U.S. law and foreign law, and 

U.S. technology companies are caught in the middle. 
2 

U.S. law places restrictions on access to data by foreign countries, making it difficult if not impossible in some instances to obtain evidence of crimes or terror plots carried out by their own citizens in violation of their laws. This has provided an incentive for 

foreign governments to enact their own legislation to address the 

problem. Some foreign governments have enacted laws requiring 

U.S. technology companies as a requirement for doing business 

there to comply with that government’s requests for data. 

Alternatively, other countries are considering legislation that 

would require U.S. providers to locate servers in that country to 

ensure that country’s jurisdiction over the U.S. provider. This is 

sometimes referred to as data localization. The disparity between 

U.S. and foreign law has similarly created a conflict with regard 

to what law governs requests by the U.S. Government to U.S. companies for data stored in foreign countries. 

Certain foreign countries prohibit the removal of data from their 

boundaries in contravention of their law. U.S. law, on the other 

hand, makes no distinction between data stored domestically 

versus data stored abroad, nor any distinction with regard to the 

nationality or location of the customer. 

The result of these conflicts is that U.S. technology companies 

find themselves with a Hobson’s choice: either comply with U.S. 

law, or comply with foreign law. But it is increasingly impossible 

to comply with both. This is an untenable situation for U.S. tech 

companies. This conflict also thwarts timely access to information 

by foreign governments, and has the potential to create additional 

barriers for U.S. law enforcement. 

Current U.S. law requires foreign governments who want access 

to content maintained by a U.S. technology company to make a 

government-to-government request for the data. 

This is generally accomplished through the mutual legal assistance treaty, or MLAT process, but frankly, the MLAT process is 

slow and cumbersome. It has been reported that an MLAT request 

takes, on average, approximately 10 months. This is clearly causing 

serious frustration from foreign governments who have legitimate 

interests in their own public safety. 

For example, a foreign government may be investigating criminal 

activity that has occurred wholly within that government’s borders 

by its own citizens, but because the perpetrators are utilizing the 

email services of a U.S. email provider, that foreign government 

cannot get access to email content for evidentiary purposes, except 

through the MLAT process, which takes entirely too long. The current arduous MLAT process likewise poses significant hurdles to 

the U.S. Government obtaining information stored abroad from 

U.S. companies, and is not designed to carry the heavy burden of 

these types of cross-border data requests. 

It is abundantly clear that Congress must find a legislative approach that embraces the modern manner in which data is stored 

and acquired internationally. 

One such approach could be bilateral agreements between the 

U.S. and foreign countries that work to resolve or waive these conflicts of law. Earlier this month, it was reported that the U.S. and 

the United Kingdom recently commenced negotiations on a bilateral agreement that would allow the U.K. Government to request 
3 

data directly from U.S. companies in criminal and national security 

investigations not involving U.S. persons. This type of agreement 

may serve as model for future agreements, and thus relieve some 

of the international pressure on U.S. tech companies, but we must 

closely examine important details, such as the legal standard for 

which the U.K. Government may make requests of U.S. tech companies, whether such requests would require an independent review, and what privacy protections should be implemented. 

Such an agreement could also help alleviate any conflicts of law 

relating to requests by the U.S. for data stored abroad by U.S. companies. But any such agreements must preserve American civil liberties and privacy protections embodied in U.S. law. 

Ultimately, in order for a bilateral agreement of this kind to 

have effect, Congress would first need to enact legislation enabling 

direct access to U.S. companies by foreign governments, and prescribing the criteria that must be met by the foreign government 

to receive such access. 

Once again, the House Judiciary Committee finds itself at the 

forefront of a pressing issue that impacts personal privacy, national 

security, public safety, economic viability, and the rule of law. 

Members of this Committee have been dedicated to finding a legislative solution to address the issues raised by the current conflict 

of laws, and we will continue to examine all options presented to 

the Committee. 

As always, we will not shy away from the heady task ahead of 

us in finding a thoughtful, balanced solution to this problem. I look 

forward to closely examining these issues today and hearing from 

our distinguished witnesses, and with that, I am pleased to recognize the Ranking Member of the Committee, the gentleman from 

Michigan, Mr. Conyers, for his opening statement. 

Mr. CONYERS. Thank you, Chairman Goodlatte. And thanks to all 

of our witnesses on both panels for the time they are taking to be 

with us today. The House Judiciary Committee is the appropriate 

forum for a topic that never seems to leave the news: how government agencies access the content of our communications. 

Over the past few years, we have explored this theme in various 

forms: government surveillance, the FBI’s effort to build back doors 

into strong encryption, and our works to reform the Electronic 

Communications Privacy Act. Today, we discuss a different aspect 

of this theme: how law enforcement agencies attempt to access data 

stored beyond their jurisdictional reach. 

Whatever your favorite policy solution may be, everyone in this 

room agrees that there is a problem that must be solved. Twenty 

years ago, a police officer in the United Kingdom investigating a 

routine crime would have had little reason to seek evidence stored 

in the United States, but today, on a daily basis, law enforcement 

agencies around the world request access to digital evidence stored 

in other countries. And the legal framework in place for making 

those requests is wholly inadequate to the task. 

The mutual legal assistance treaty system was written for a different era, and struggles to keep pace with the scope and pace of 

modern communications. Our Members have also been outspoken 

in the need to modernize the Electronic Communications Privacy 

Act, and I hope we will do it soon. 
4 

I am also a co-sponsor of H.R. 1174, the ‘‘Law Enforcement Access to Data Stored Abroad Act.’’ Now I signed onto this bill because it is an important vehicle for the discussion that we will have 

today, and I thank the gentleman from Pennsylvania, Mr. Marino, 

the gentlelady from Washington, Ms. DelBene, and Mr. Amodei, 

Nevada for their leadership on this issue. The LEADS Act takes a 

holistic view of the system. 

It reforms ECPA to require warrants for content in the domestic 

content. It also provides one solution for Federal law enforcement 

to reach data that is stored abroad. And, it begins a much needed 

overhaul of the mutual legal assistance treaty framework, and even 

if we may reach consensus on a solution that differs from the 

LEADS Act, it will have been important legislation for having recognized early that we need to use every tool in our toolbox to update Federal law for the digital age. 

One other possibility for reform that I would like to discuss today 

is the idea of bilateral agreements with our closest allies. Those 

Nations we trust most on civil liberties and due process issues. We 

should add this concept to the mix. In addition to amending the 

Electronic Communications Privacy Act, and updating our treaty 

system, these agreements could counter the trend toward data localization, incentivize our partners to set better standards for data 

protection, and help our closest friends investigate serious crimes 

that often impact the United States either directly or indirectly. I 

would add only two notes on this topic for our distinguished guests 

from the Department of Justice. 

First, I hope to have your agreement today that no deal with the 

United Kingdom is better than a deal that does not honor privacy, 

due process, and free expression on both sides of the Atlantic. 

Secondly, I hope that this will be a collaborative process. It is unfortunate that we learned about your discussions with the British 

from the Washington Post before we heard about them from you. 

I appreciate that the Department took the time to brief Committee 

staff earlier this week. It was important, I appreciate how candid 

the Department was about possible civil liberties concerns going 

forward. I am sure that working together, we can come up with a 

system of reforms that benefits each of the stakeholders in this discussion. 

And so I thank the Chairman and yield back any time that 

might be remaining. Thank you. 

Mr. GOODLATTE. Thank you, Mr. Conyers. And without objection, 

all other Members’ opening statements will be made a part of the 

record. 

[The prepared statement of Ms. Jackson Lee follows:] 
5 
6 
7 
8 
9 
10 
11 

Mr. GOODLATTE. We welcome our distinguished witness of today’s 

first panel. And if you would please rise, I will begin by swearing 

you in. Do you swear that the testimony that you are about to give 

shall be the truth, the whole truth, and nothing but the truth so 

help you God? Thank you very much. 

And I will now introduce our witness for today’s first panel. Mr. 

David Bitkower serves as the Principal Deputy Assistant Attorney 

General of the U.S. Department of Justice. Prior to joining the 

criminal division at the DOJ, Mr. Bitkower was an Assistant 

United States Attorney in the eastern district of New York. 

He is a graduate of Yale University and Harvard Law School. 

Your written testimony will be entered into the record in its entirety, and we ask that you summarize your testimony in 5 minutes 

or less; and to help you stay within that time, there is a timing 

light on your table. When the light switches from green to yellow, 

you have 1 minute to conclude you testimony. When it turns red, 

that is it. Your time is up. Welcome. Please begin. 

TESTIMONY OF DAVID BITKOWER, PRINCIPAL DEPUTY ASSISTANT ATTORNEY GENERAL UNITED STATES DEPARTMENT OF JUSTICE 

Mr. BITKOWER. Thank you. And good morning Chairman Goodlatte, Ranking Member Conyers, and Members of the Committee. 

Thank you for the opportunity to testify on behalf of the Department of Justice concerning international conflicts of law, cross border data flow, and law enforcement requests. The Department recognizes that issues concerning cross border law enforcement access 

to data, while vitally important, can be complex and require balancing several sometimes competing goals. 

Mr. GOODLATTE. Mr. Bitkower, you may want to pull that microphone a little closer to you. 

Mr. BITKOWER. Certainly, thank you. Most importantly, we must 

fulfill the responsibility that Congress and the American people 

have entrusted to us by taking lawful steps to protect Americans 

from threats to their safety and security. But we must also do our 

best to meet legitimate public safety needs of other countries that 

require access to evidence that happens to be stored in the United 

States without compromising users’ privacy interests, and we must 

recognize that U.S. service providers, seeking to compete in a global marketplace, may in some instances face conflicting legal obligations from the Nations where they choose to do business; and we 

should seek to minimize those conflicts where possible. 

Finding solutions that satisfy all of these goals will be difficult, 

and we welcome this hearing as part of an important discussion 

about how to do so. I will focus on two issues this morning. 

First, I will discuss the increasingly important role that cross 

border access to data plays in the protection of the public, both for 

the United States and for our foreign partners. Second, I will discuss a potential new opportunity to build a framework for cross 

border access to data that would facilitate legitimate law enforcement requests for electronic information, help to alleviate conflicts 

of law as faced by service providers, and protect privacy and civil 

liberties. 
12 

Two related trends have significantly increased the need for U.S. 

law enforcement to be able to access electronic data that may be 

stored overseas. 

First, the rapid growth of Internet use has meant that law enforcement increasingly relies on electronic data, such as the content 

of emails or text messages, in identifying perpetrators and bringing 

them to justice. 

Second, while much of this information is stored within the 

United States, providers are increasingly storing information outside the United States as well. United States law generally does 

not require providers to store data here, and U.S. providers increasingly face tax or other business incentives as well as pressure 

by foreign governments to store data outside the United States. 

In fact, many of the largest American providers now operate data 

centers abroad, and it is unusual for a major provider to store all 

of its data within a single country. For these reasons, although law 

enforcement access to data stored abroad is already a key issue for 

the United States, its importance is likely to grow over time. Under 

United States law, when a provider is subject to the jurisdiction of 

U.S. courts, U.S. law enforcement may use the Stored Communications Act, or SCA, to obtain this data. 

The SCA’s efficient and privacy protecting process is critical to 

successful investigations. When SCA process is unavailable, U.S. 

law enforcement may attempt to obtain information stored abroad 

through international cooperation mechanisms, such as mutual 

legal assistance treaty, or MLAT requests, but the MLAT system 

can be cumbersome and is overburdened, and the United States 

does not even have MLAT treaties with half the countries in the 

world. 

As a result, criminals may remain free to commit serious crimes 

against Americans. The United States is of course not alone in confronting these challenges. Many of our foreign partners, including 

close allies such as the United Kingdom, find themselves in an 

even more difficult situation reliant on evidence stored outside 

their borders, often within the United States, to protect public safety and national security. The difficulty arises in part because the 

SCA not only serves as the mechanism for U.S. law enforcement 

to require a provider to disclose information, but also precludes 

providers from disclosing the contents of communications unless 

certain exceptions are met; and the SCA contains no exception permitting a provider to disclose the contents of communications in response to a foreign production order. 

Thus, when a foreign country makes a request under its own law 

for an American provider to disclose data stored in the United 

States, the provider may face conflicting legal demands, compulsion 

to disclose under foreign law, and simultaneous preclusion of that 

disclosure under American law. This is so even if, for example, the 

order relates solely to a crime committed by the country’s national 

within its own territory. 

The result may be to stymie legitimate investigations, motivate 

foreign countries to require data to be stored within their own borders, and expose American companies and their employees to potential enforcement actions abroad. There is widespread acknowledgement that this status quo is untenable. To address these prob-
13 

lems, the Administration is currently considering a framework 

under which U.S. providers could disclose data directly to the 

United Kingdom in response to a lawful U.K. order. The agreement 

would not permit the targeting of U.S. persons or persons within 

the United States, and would not be used for bulk collection. The 

agreement would also secure reciprocal access for the U.S. to data 

located in the United Kingdom. We recognized that any such agreement would require legislation, both to lift conflicts of laws in carefully specified circumstances, and also to set forth base line standards to project privacy and civil liberties. 

We look forward to working with Congress as we continue to explore this approach. Should the approach prove successful, we 

would consider it for other like-minded governments as well. We 

believe the framework I have described rather than legislation that 

would unilaterally restrict U.S. law enforcement authority, offers a 

path forward to efficient and privacy protecting cross border law 

enforcement access to data. Thank you, and I look forward to answering your questions. 

[The prepared statement of Mr. Bitkower follows:] 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 

Mr. GOODLATTE. Thank you. We will now begin the questioning, 

and I will recognize myself. Mr. Bitkower, what will happen if Congress fails to implement legislation to facilitate international agreements such as the one currently being negotiated with the United 

Kingdom? 

Mr. BITKOWER. Thank you for the question, Congressman. And 

I think it goes to the heart of why such a framework is so helpful. 

As we said, the status quo today is untenable, both for our close 

allies and for our companies. If there is no agreement or path forward, then our companies will increasingly face conflicts of law situations when foreign countries, including close allies such as the 

United Kingdom, have legitimate requests for data related to legitimate investigations under their own law, the only connection to the 

United States of which is that the data happens to be stored here, 

and the provider is precluded under United States law from complying with that request. 

I think we will see that situation continuing to grow as crime becomes more international and as data can move around more easily, and if we do not resolve those questions, then we will face both 

continuing pressure from our allies as well as continuing pressure 

on our own companies. 

Mr. GOODLATTE. Do you agree that the Stored Communications 

Act is silent as to whether its procedures apply to data stored outside the U.S. or to non-U.S. persons outside the U.S.? 

Mr. BITKOWER. Again, thank you for the question, Congressman. 

So, the U.S. Stored Communications Act is a form of compulsory 

process. And U.S. law at the time the SCA was enacted and in fact, 

for many decades has provided the compulsory process, if served on 

a company within the jurisdiction of the United States, can require 

that company to produce materials, even if those materials happen 

to be stored abroad. This has been the law of the United States for 

many decades and in fact many countries have similar laws. I 

think we saw, in fact, even in the case involving Microsoft in Ireland. 

Mr. GOODLATTE. Yeah, can you answer the question though? Is 

it silent with regard to these parties? 

Mr. BITKOWER. So the text of the law does not particularly mention where the data is stored and does not turn one way or the 

other in where data is stored. 

Mr. GOODLATTE. So, what guidance do U.S. providers have as to 

the application of the Stored Communications Act to data or customers that are outside the U.S.? 

Mr. BITKOWER. So again, we think that since this SCA was legislated against a backdrop of U.S. law, which applies across a variety 

of contexts, not just in electronic communications contexts. 

Mr. GOODLATTE. Is your answer that it does not give guidance 

to this? 

Mr. BITKOWER. No, to the contrary, sir. My answer is that it operates like other forms of compulsory process where the law is clear 

that companies may be required to retrieve data from abroad in response to a lawful request. 

Mr. GOODLATTE. Okay. Should a bilateral agreement such as the 

one under consideration with the U.K. also ameliorate any conflicts 
30 

of law with regard to U.S. requests for data held by U.S. companies 

in that other country that is a party of the bilateral agreement? 

Mr. BITKOWER. Yes, Congressman. One of the primary benefits 

in an agreement of this nature would be to have reciprocal benefits 

for the United States in lifting any conflicts of law that might be 

present in the other country from where we request data. 

Mr. GOODLATTE. And in your written testimony, you say that a 

successful bilateral framework must establish adequate base lines 

for protecting privacy and civil liberties, both through the agreement and implementing legislation. And you also go on to say that, 

for example, legislation should require the foreign country’s law to 

have in place appropriate substantive and procedural protections 

for privacy and civil liberties. What does that mean? 

Mr. BITKOWER. So thank you, Congressman. That is an area 

where we had hoped to work very closely with Congress and in particular with this Committee in establishing what those base lines 

ought to be. Our goal is that when we choose a country to conclude 

such an agreement with, we would want to ensure that that country has adequate substantive and procedural base lines to ensure 

that the orders that they are submitting and serving on our providers are ones based on a rule of law framework, they provide protections for civil liberties, they provide protections for privacy. And 

so that way our companies can be sure they are complying with legitimate requests. 

Mr. GOODLATTE. Thank you very much. I now recognize the gentleman from Michigan, Mr. Conyers for his questions. 

Mr. CONYERS. Thank you, Mr. Chairman. And welcome to our 

hearing, sir. In the case pending before the Second Circuit right 

now, the Department of Justice and Microsoft differ on the application of the law to data stored on servers outside the United States. 

I would like to focus on some areas that I think we may be in 

agreement on. Do you believe that companies like Microsoft face a 

difficult decision when U.S. laws like the Electronic Communications Privacy Act dictates one outcome, and the law of a different 

country dictates another? That is a pretty difficult situation, is it 

not? 

Mr. BITKOWER. I absolutely agree, Congressman. Our companies 

currently can be caught in difficult conflicting legal obligations, in 

particular when foreign countries seek access to data that is stored 

here in the United States. 

Mr. CONYERS. Do you believe that the Electronic Communications Privacy Act should be reformed to address this issue? 

Mr. BITKOWER. So, thank you, Congressman. I am aware this 

Committee held a hearing in December on the subject of the Electronic Communications Privacy Act. The Department was privileged to submit testimony to that hearing, and obviously we stand 

by that today. We recognize that certain aspects of the Electronic 

Communications Privacy Act have not kept date with the way technology is used, and the Department is open to certain changes in 

that statute, provided contingencies are made to protect important 

civil and criminal law enforcement functions. 

Mr. CONYERS. Now, in February, the Washington Post reported 

that the Department of Justice had entered into negotiations with 

the British government on an agreement that would allow British 
31 

agencies to serve wiretap orders directly on United States companies. Do you think it might have been appropriate for us to learn 

about this activity from the Department of Justice rather than the 

Washington Post? 

Mr. BITKOWER. Certainly, Congressman. We believe that close 

collaboration with Congress is essential in this area as in many 

others. I do not want to overstate any progress we have made. The 

negotiations began just very recently. We only very recently received, in fact, the authorization to begin those negotiations, at approximately the time that that Washington Post article was published. We obviously did look forward to the opportunity to brief 

this Committee and other Committees of jurisdiction and we hope 

to work with you in the future as well. 

Mr. CONYERS. Well, is it your position that our government 

should be able to obtain data stored abroad by applying the Electronic Communications Privacy Act to any company based in the 

United States? 

Mr. BITKOWER. Thank you, Congressman. We think it is essential that the United States be able to obtain data without regard 

to its location, if the provider is subject to U.S. jurisdiction. As I 

noted in my testimony, there are numerous examples of cases 

where individuals who may be outside the United States, who may 

not be United States citizens, whether they are in the United 

States or not, commit very serious crimes against Americans, and 

if we do not have access to data and evidence, then those crimes 

could continue. So we do take seriously potential conflicts of laws 

that our companies may face. 

We do everything in our power to minimize those and see if there 

are work arounds we can engage in. But at the end of the day, if 

the United States does not have the authority to gather evidence 

simply based on the location of that evidence, then not only will 

our citizens suffer, but in fact, an agreement of the type we are 

talking about today, would have no reciprocal benefit for the 

United States. 

Mr. CONYERS. All right. Is there some way we can speed up the 

negotiations and the conferences and all this business so that this 

does not take months and months, and jeopardize the interest of 

a lot of individuals and companies? How would we react if the Chinese government, for example required, a Chinese company like 

Alibaba, which maintains the data center in the United States, to 

produce account information that belongs to a U.S. citizen or citizens? 

Mr. BITKOWER. So thank you, Congressman. Again, that is I 

think one of the key conflicts of laws that our companies may face. 

That is they receive requests from other companies in other countries, for data that our companies may store in the United States. 

Sometimes those are requests that they very much want to respond 

to. Legitimate requests from close allies to resolve crimes in their 

territory; and sometimes they come from countries who do not have 

the same human rights record and where the request is not as obviously legitimate. 

We do not believe the solution to that problem is to enact legislation that would unilaterally strip U.S. authority to investigate serious crimes, but we do think a framework of the type I am talking 
32 

about today, under discussion between the U.S. and the U.K., 

which allows us to pick and choose likeminded countries and circumstances in which we would reduce those conflicts is a path forward. 

Mr. CONYERS. Well, I hope we work more closely together in this 

area, and I thank you for your response to my questions. And I 

thank the Chair. 

Mr. BITKOWER. Thank you. 

Mr. GOODLATTE. The Chair recognizes the gentleman from California, Mr. Issa, for 5 minutes. 

Mr. ISSA. Thank you, Mr. Chairman, Mr. Bitkower. Is it 

Bitkower? 

Mr. BITKOWER. Yes. 

Mr. ISSA. Okay. Sometimes, here from the dais, the best way to 

deal with a new problem is see if the problem is new or not. So 

let me ask you a few questions just to see if the problem is new. 

The country of Ireland decides that, in fact, you committed a crime, 

and they want you back there. Should they be able to simply unilaterally go to an Irish court, issue a warrant, and come get you? 

Mr. BITKOWER. So if the country grounds had an extradition request for me? 

Mr. ISSA. No, no. They just want to come haul your ass in. 

Mr. BITKOWER. I would oppose that, sir. 

Mr. ISSA. Okay. So, in the tangible world, that is an example 

where we have absolutely no authority whatsoever to take a person—by the way, U.S. or otherwise, from another sovereign country. We have had a long tradition—and I just left the Foreign Affairs Committee—I have got Secretary Kerry there so I apologize 

I am going back and forth between the two most important people 

I will see today—so, for all these years we have set up a list of 

countries in which we do business on extradition. 

We want tangible evidence. Let’s just say an M-16 used in a 

crime, but it left the country. Or, an M-16 was found in Ireland 

being used, but we believe it is from the U.S. When you want that 

tangible property, you do not go to a U.S. court order alone. You 

go to a U.S. court to plead your case, and then you go to a foreign 

jurisdiction, and you negotiate with the foreign jurisdiction whether or not, as to that person, as to that equipment, as to that evidence, they are willing to, through their court system, allow you access or, in fact, removal from their country. Correct? 

Mr. BITKOWER. So the question is—Congressman, I do appreciate 

the question, I think, across a wide variety of contexts. We face a 

wide variety of situations where we—there may or may not be a 

conflict of law. 

Mr. ISSA. Right, but let’s just look at the intangible world, the 

piece of paper reduced to a PDF. Because that is really what we 

are talking about. We are talking about something that could be 

tangible fairly quickly but happens to be in electronic format, correct? 

Mr. BITKOWER. Certainly. 

Mr. ISSA. Okay, and you want us to assume that somehow, as to 

U.S. corporations, Microsoft, Apple, whoever it happens to be, that 

in my opinion the bully—is being bullied by the Justice Department today in some ways. You want us to believe that you should 
33 

throw out all the history of extradition, all the history of you do 

not get it, you get to ask another country for it. And you want to 

have an absolute right to demand it and get it if a U.S. court says 

it, and you have jurisdiction over the entity who could control the 

bringing of it back electronically to you. Is that correct? 

Mr. BITKOWER. That is not precisely correct. 

Mr. ISSA. It is pretty close though, is it not? 

Mr. BITKOWER. Well, respectfully, sir, the U.S. courts do have a 

long tradition of balancing—— 

Mr. ISSA. I am not asking what the U.S. court is. I am asking 

what you are asking for. You are asking for the U.S. courts to summarily order U.S. corporations or any entity that you believe the 

court has jurisdiction over, to deliver to you something from another country and circumvent that other country’s opportunity to 

tell you yes or no. And that is essentially what you are asking for. 

So let me ask it in another way, and I will be asking the next 

panel. Should we not fashion legislation that treats intangible evidence exactly the same as we treat tangible evidence? That treats 

the summoning of something from somewhere else to the United 

States substantially similar to how we would do so if, in fact, it 

was tangible, like a person, M-16, or a piece of paper? Is that not 

where—not your position. Your position is rightfully so, self-serving, that you would like the evidence as quickly and easily as possible. But from our standpoint, our Founding Fathers saw 200 

years evolve without this sort of an idea that you can order an U.S. 

entity to bring back something to the United States. 

Can you give me a good reason as the time expires—I will give 

you the rest of the time and as much as the Chairman gives us— 

can you give me the good reason why I should treat this intangible 

substantially different than we have treated tangible for 240 years? 

Mr. BITKOWER. So thank you, Congressman. We do not believe 

that our position either in the Microsoft case or with regard to the 

SCA treats tangible and intangible objects differently. As I said before, there is a long tradition where corporations and banks, for example, subject to U.S. jurisdiction, may be required by lawful process in the United States to retrieve documents from abroad. If after 

that order is given, the provider can show, or the company can 

show that there is legitimate competitive laws we work every with 

companies in that context, in our financial investigations, in trade 

secret investigations, and so on. 

Mr. ISSA. So you go to the court, you get an order, and then with 

the threat of the order and the financial loss to them you negotiate. 

Is that right? 

Mr. BITKOWER. That is correct. 

Mr. ISSA. But only if they file an opposition and they are tying 

it up in court. Then you negotiate because you want it faster. Is 

that right? 

Mr. BITKOWER. That is not correct. They do not have to file an 

opposition. They simply have to tell us there is a conflict of laws 

and we will talk to them right away. I will point out in the Microsoft litigation you are referring to, there has been no claim or allegation by Microsoft of any conflict of law. 

Mr. ISSA. Thank you. Thank you, Mr. Chairman. 
34 

Mr. GOODLATTE. The Chair recognizes the gentlewoman from 

California, Ms. Lofgren, for 5 minutes. 

Ms. LOFGREN. Well, thank you, Mr. Chairman, and thank you for 

scheduling this and a series of hearings on this important topic before our country. You know, I will just join with the other Members’ concern with the negotiations with Britain with the newspaper instead of from the Department. I just do not think that is 

the way this should work. And looking at that, I just got to express 

some concerns. 

Yes, Britain is our ally, but they do not have a First Amendment. 

I mean, they do not protect speech. And they do not have judicial 

review. I mean, they do not have a magistrate that oversees the 

issuance of warrants. And they do not have a probable cause standard either. So to think that just because they are our ally, they 

meet our standards I think is completely mistaken, and I have very 

grave concerns about what is going on. 

Obviously this is not the focus of this hearing, but I will just get 

that out there. I have very grave concerns. And certainly Britain 

is moving in a direction away from what we would consider basic 

liberties that are guaranteed by our Constitution. So their direction 

in our negotiation I think is cause for grave concern in this country. And I will—we are going to have to get further into that later. 

Since you are here, I would like to ask a couple of questions 

about ECPA reform, because I think what we do with ECPA reform 

will greatly impact the conflict of laws issues that is the subject of 

this hearing. We have a bill that has, I think, hundreds of co-sponsors. I am for that bill. But what the bill does not have in it is protection for geolocation. Now, our Supreme Court is moving in the 

direction of projection geo location, so it may be that our Supreme 

Court is going to solve that, even though the legislation does not 

include it, but I am interested in the Department’s policy. 

Now, it is my understanding that the Department recently enacted a policy requiring a warrant before deploying a cell site simulator, sometimes called a StingRay, to locate a suspect using their 

cell phone. Does that mean that the Department of Justice is going 

to require a warrant for all other means of obtaining real time geo 

location information of a person or mobile device? And if not, what 

technologies and techniques require a warrant and which do not? 

Mr. BITKOWER. Thank you, Congresswoman for raising two different but both very important issues. Initially, with respect to the 

U.K., I do want to emphasize we are at an early stage in the negotiations. We fully recognize and appreciate that Congress will have 

to legislate in this area, and we hope to work with this Committee 

and others in order to establish the appropriate base line standards 

for the protection of privacy and civil liberties. 

And I will also note, as you note, that the U.K. has introduced 

substantial reforms to its Investigative Powers Act. Any determination with respect to any country, including the U.K., will only be 

made after there is legislation in place at that time. With respect 

to geo location, I will note also at the beginning we follow the law, 

whether it is in the statute or created by court decisions, including 

the Supreme Court. So we will follow it, obviously no matter what 

the circumstance is. 
35 

There is no single category of geo location data that law enforcement can obtain from third parties. There are various types of data 

and various types of technology. It depends whether you’re looking 

at prospective information or historical information, information 

provided voluntarily by an individual, or information collected 

without their consent. And they vary in terms of precision. So our 

practices vary depending on the type of information, and the type 

of technology, and we make the showing that is required under law 

for any of those. 

Ms. LOFGREN. So, let me ask you this. If you are requiring a warrant for—which I must say, apparently the U.S. Marshals Service 

is not—to deploy StingRay for real time geo location would you require a warrant generally to obtain historical geo location? 

Mr. BITKOWER. So, again Congresswoman, it depends on what 

you mean by geo location information. 

Ms. LOFGREN. Where you are. 

Mr. BITKOWER. Well, again, that can be determined with different degrees of precision. That could be as precise as are you in 

this room? It could be more generally, are you in the city? Or are 

you in this country? When you get more precise, generally speaking 

the law does require a higher showing, often including a warrant 

based on probably cause. When you are less precise, often the law 

requires a lower showing and we will follow that law. 

Ms. LOFGREN. Well, in some cases there is a void in terms of the 

law, in terms of where the court has so far acted. So it sounds like, 

Mr. Chairman, that as we take this up, we may want to include 

some geo location protection and precision to guide the Department 

in the future, and I see my time has expired, and I would yield 

back. 

Mr. GOODLATTE. The Chair thanks the gentlewoman and recognizes the gentleman from Iowa, Mr. King, for 5 minutes. 

Mr. KING. Thank you, Mr. Chairman. Thanks for your testimony, 

Mr. Bitkower. I would like to ask you about the broader picture of 

this. I mean, we are bouncing this back and forth between the 

United States and the U.K., and it is far more complex than this 

as I understand it. And the several hundred countries there are in 

the world, that would seem to me that that is several hundred different bilateral relationships that need to be negotiated. Could you 

paint this big picture on what would be the optimum here? I mean, 

if we had the picture of what’s optimum, perhaps then, as we move 

the pieces around on this jigsaw puzzle, we might be able to get 

that picture eventually put together, or at least have a target? 

Mr. BITKOWER. Sure, and thank you, Congressman. And I will do 

my best. I think we all start from the recognition that the current 

situation is untenable, and the optimum would be to move in the 

right direction, which means both to facilitate legitimate requests 

from countries to solve crimes and protect public safety, but also 

to take our companies out of the middle when they are stuck between conflicting legal obligations, both of which they respect. 

We do not believe that we will wind up with 181 bilateral agreements. I think that is not even close to being contemplated. There 

are not that many countries, I think, that share our values in that 

sense that would be willing to conduct such an agreement with. If 

it proves successful with the U.K., however, we would be amenable 
36 

to exploring it with other countries with whom we have similar 

close relationships, and who have similar values and have similar 

rule of law respecting systems. 

So I think the approach that we want to take is one that solves 

the problem that we see, the problem being lack of access because 

of conflicting laws and our country is caught in the middle. The approach we want to avoid is one that would unilaterally strip U.S. 

law enforcement of its authority to protect Americans, even in 

cases where there are no conflicts. 

Mr. KING. I would add to that, that by some of the memos here 

I have in front of me, there is an indication that perhaps just valuable evidence in a criminal investigation might be delayed as long 

as 10 months. It would seem to me that that would be a big discouragement from the prosecutors in whichever country was waiting for 10 months. How much is that a consideration of your initiative here? 

Mr. BITKOWER. That is an everyday consideration, sir, for the 

most serious crimes we face, ranging from terrorism to child sexual 

exploitation to computer crime, and I will add the 10 months is an 

estimate of the time it takes us to respond to requests from foreign 

countries. 

When we are talking about situations where the Department of 

Justice is required to request information—I am sorry, the 10 

months is when we produce information. When we are talking 

about situations where we are required to request information from 

foreign countries, 10 months may be a best-case scenario. In many 

cases we will never see that evidence at all, and in many cases we 

do not even have a mutual legal assistance treaty, as I said, with 

about half the countries in the world. 

So, if we are required to pursue international cooperation mechanisms to gather evidence, that is going to stop many important investigations dead in their tracks. 

Mr. KING. So that would imply that there are many criminals 

going free because of these delays. 

Mr. BITKOWER. There is no question that that is true, sir. 

Mr. KING. And also, what about intelligence purposes? Say investigations of radical Islamic terrorists? How much of this proposal 

is contemplated that would be gathering that kind of intel? 

Mr. BITKOWER. So that is a core consideration. So, if, for example, the United Kingdom was investigating a U.K. citizen who had 

gone off to Syria to fight with ISIL, and was communicating with 

his co-conspirators through a U.S. provider, and that data was 

stored in the United States, right now the U.K. would have to come 

to us for an MLAT, and we would have to go through all those 

same procedures. 

By the same token, when we investigate Syria’s terrorism offenses—and I have a couple in my written testimony—quite often 

terrorists are non-U.S. persons who are located overseas, and that 

might be exactly the type of data that our providers store overseas. 

If we have to go through MLAT procedures to obtain that evidence, 

and if any conflicts of law are automatically resolved against the 

United States, those investigations will automatically suffer. 

Mr. KING. Let me just suggest then that if we are contemplating 

a degree of change in our foreign policy, that Mr. Issa referenced 
37 

foreign policy and foreign affairs—a change in our foreign policy 

that we were committed to actually defeating ISIS and doing so in 

a comprehensive way, not only tactically in the Caliphate, but 

throughout our initiation of a global war against terrorists, and 

using data as a component of that as well as finances, would you 

say that this is a critical element that we are addressing here 

today? 

Mr. BITKOWER. When it comes to the fight against terrorism by 

both us and our allies, access to evidence stored abroad is a key 

part of that. Absolutely. 

Mr. KING. And right now we are handcuffed to a degree? 

Mr. BITKOWER. Yes. 

Mr. KING. Thank you. I appreciate your testimony, Mr. Bitkower, 

and I yield back the balance of my time. 

Mr. MARINO [presiding]. The Chair now recognizes Mr. Johnson 

from Georgia. 

Mr. JOHNSON. Thank you, Mr. Chairman. Sir, thank you for your 

testimony today. In what ways, if any, would a bilateral or series 

of bilateral agreements be preferable to a mutual legal assistance 

treaty? 

Mr. BITKOWER. Thank you, sir, for the question. So let me say 

from the very beginning, the mutual legal assistance process is a 

vital part of international cooperation. We rely on it all of the time 

on a daily basis, and I do not by any means mean to suggest that 

that is not a key element going forward, but the mutual legal assistance process can be burdensome, because it requires essentially 

a diplomatic request from one country to another, the need for a 

country to translate its documents not only in terms of language 

but also in terms of legal process. 

Mr. JOHNSON. Well, that is within the current framework of— 

yeah. 

Mr. BITKOWER. Exactly, exactly. And the idea of a new framework of the type I am talking about today between the U.S. and 

the U.K. is that it would permit direct requests from the U.K. 

under U.K. law to providers that are doing business in the U.K. 

And that would circumvent the need to go through all the procedures in the MLAT process that are not privacy protecting, that do 

not enhance investigations, but simply add time and delay. 

Mr. JOHNSON. A new MLAT process or framework could incorporate the features of the bilateral agreement that is being negotiated with the U.K. Is that not correct? 

Mr. BITKOWER. So, in a sense the U.S.-U.K. framework is one of 

mutual legal assistance, but it is not mutual legal assistance in the 

type contemplated by our current treaties, which require requests 

to go through those diplomatic channels. 

Mr. JOHNSON. Well, I guess I am getting to the issue of whether 

or not it is better to try to, for this country, to address its crossborder access to data issues—and other countries that have the 

same issue—whether or not it is better to negotiate within a treaty 

format as opposed to a series of bilateral agreements. Why would 

a bilateral agreement process with at least 190 different Nations 

in this world—why would that be a superior route as opposed to 

a treaty? 
38 

Mr. BITKOWER. So, I absolutely agree with you. We should continue to work and reform the MLAT system, and there are a number of steps that we are taking in that regard. And we are happy 

to work with this Committee and others to continue to do so. That 

is an essential step as well. 

Mr. JOHNSON. It seems like that is on the back burner though. 

Mr. BITKOWER. Not at all, sir. That is actually on the front burner for the Department of Justice, and it is an area where we put 

a lot of resources and intend to continue to do so. In fact, we think 

a framework of the type—a bilateral framework with the U.K. of 

the type I have discussed would actually contribute to reforming 

and improving the MLAT process, because it would take certain 

high volume countries like the U.K. out of that system to a degree 

and free up resources for uses for all other countries, even those 

that are not part of the framework. But the reason we would go 

through a bilateral framework is for certain close allies with particularly—with legal systems that have adequate substantive and 

procedural protections for privacy and civil liberties, the idea is 

that this would be an expedited method, that they would not have 

to go through the normal MLAT procedures for crimes that are of 

particular concern to them, and do not involve U.S. persons, they 

have not targeted at U.S. persons or persons located in the United 

States. 

So we would get the best of both worlds in a sense of expediting 

process that have privacy protecting features and favor our close 

allies, but also lifting all boats by freeing up resources for people 

who are not part of that process. 

Mr. JOHNSON. So, I presume that you are working under the assumption that British legal standards are acceptable with respect 

to U.S. legal standards? 

Mr. BITKOWER. So, again, we are not working on any assumptions. We recognize the need to and we look forward to working 

with this Committee and others to establish exactly what those 

standards ought to be and only then would be evaluate the U.K. 

as an applicant for such a process. 

Mr. JOHNSON. And, last question: would a bilateral agreement 

with the U.K. waive U.S. Fourth Amendment protections with respect to requests from British for electronic data stored here in the 

U.S.? 

Mr. BITKOWER. So, any agreement obviously would require 

MLAT legislation and that legislation would have to be consistent 

with the Fourth Amendment. We certainly recognize that. The 

Fourth Amendment, of course, takes particular views with regards 

to investigations by foreign governments as opposed to our own. Or 

data that does not belong to U.S. persons or persons who are in the 

United States. 

Mr. JOHNSON. Thank you. And would a bilateral agreement be 

subject to congressional approval? 

Mr. BITKOWER. So Congress would have to enact legislation to 

make this entire process possible, sir. 

Mr. JOHNSON. Thank you, and I yield back. 

Mr. MARINO. The Chair now recognizes the gentleman from 

Texas, a former judge, Congressman Poe. 
39 

Mr. POE. I thank the Chair. I am over here on the far right. Let 

me just go back to the basic, what the law is right now. Under current law, information that is stored in the cloud that is over 6 

months old, the Department of Justice, on behalf of some law enforcement agency, makes a request or a demand to the provider for 

that information in the cloud such as an email that belongs to 

Bubba down in Texas. Is that a fair statement of what the law is 

right now? 

Mr. BITKOWER. Yes, sir. For the content of email, we would generally proceed with a warrant. 

Mr. POE. Okay. You would get a warrant from a judge. 

Mr. BITKOWER. Yes, sir. 

Mr. POE. When is it you do not get a warrant, but you get a subpoena or a request made by some person in the Department of Justice? 

Mr. BITKOWER. So we would proceed by subpoena with—under 

the SCA with respect to certain non-content information, such as 

metadata, or subscriber information. 

Mr. POE. So that is not a law enforcement agency, though. Is 

that correct? 

Mr. BITKOWER. That would be on behalf of law enforcement agencies, sir, yes. 

Mr. POE. Oh, a law enforcement agency. So when do you request 

the subpoena and when do you have to get the warrant? 

Mr. BITKOWER. So the Department’s practice is to seek a warrant 

when content of the communications are at issue, sir. 

Mr. POE. But to get the data, you issue a subpoena. 

Mr. BITKOWER. For certain types of non-content information, that 

is correct, sir. 

Mr. POE. Okay. And, right now, Congress, for the last 4 years, 

has been discussing and trying to update ECPA to deal with the 

issue of content and information that is stored in the cloud that is 

over 6 months old. Is it the Department of Justice’s position that 

a warrant should be required to get that information, whether it 

is data or whether it is content? 

Mr. BITKOWER. So the Department is open to a warrant requirement for that type of data if exceptions for certain limited contingencies involving civil investigators are made. 

Mr. POE. Okay. All right. And just so you are clear, I think that 

the—you ought to have a warrant for all of that. And the reason 

that the SEC wants to have an exception is exactly the reason that 

the SEC should have a warrant requirement as well. Its content I 

think is—or data I think is protected under the Fourth Amendment. That is one of the bills that we are debating here. And regardless of what we eventually come up with, do you think it is important that Congress actually make a decision on reforming 

ECPA? 

Mr. BITKOWER. So again, the Department is certainly open to 

that change that you are describing, and I would agree with you 

that any access to data has to comply with the Fourth Amendment. 

There are ways other than warrants to comply with the Fourth 

Amendment, and we think those ways might be available to civil 

investigators. 
40 

Mr. POE. And I think it ought to apply to the civil agencies in 

the Federal Government as well. That is my personal opinion. Do 

you think that Congress—I am asking your opinion if you are open 

to it, are you open to it now, or do you think we ought to wait to 

figure out some deal with the British on what they are doing? Or 

should we go ahead and make that decision as our responsibility 

in Congress? 

Mr. BITKOWER. So certainly, we do not see one process as dependent on the other. Our concern is when, for example, DOJ civil 

investigative agencies or civil components, such as the Civil Rights 

Division, do need to seek information for an important civil rights 

investigation, and they are not able to get a warrant because it is 

not a criminal investigation. And in that case there ought to be 

some mechanism for them to get access to data from the provider, 

but with full privacy protections, and we are open to a variety of 

solutions in that regard. 

Mr. POE. I did not ask you that. I asked you about dealing with 

the British. I did not ask you about civil rights. Do you think that 

we ought to wait to deal—make a treaty with the British on content that is stored in the cloud, and what they think and what we 

think and come up with some agreement, treaty, whatever it is 

called, or should we act on behalf of the American public now? 

Mr. BITKOWER. We do not think there is any need to wait to act 

on ECPA, but to resolve the situation with the U.K. either, no. 

Mr. POE. All right. Well I agree with you on that. That is Congress’ responsibility, and it is long overdue that we deal with storing information in the cloud, and I think the Fourth Amendment 

ought to apply to the information stored in the cloud, over 4 

months or over 6 months old, whether it is civil process or criminal 

process. And maybe we will get that legislation that is now pending 

with over 300 sponsors of Congress to the House floor soon. Thank 

you very much; I will yield back the balance of the time. 

Mr. MARINO. Chair now recognizes the congresswoman from the 

great State of Washington, Congresswoman DelBene, who is a coauthor with me on the LEADS Act. 

Ms. DELBENE. Thank you, Mr. Chair, and you thank you, Mr. 

Bitkower, for being with us today. The DOJ argued in the Microsoft Ireland case that congressional inaction with respect to updating the Electronic Communications Privacy Act is evidence of legislative intent, and that Congress generally think the law is fine, but 

the courts should feel free to apply it to all of the unique situations 

that arise given the way technology works today, including international data storage. Now as was mentioned by my colleague from 

Texas moments ago, are you aware that this Committee has held 

hearings and announced plans to mark up the Email Privacy Act, 

and there are over 300 cosponsors on that very basic reform bill 

waiting for this Committee to take it up, and over 100 on the 

LEADS Act that addresses the international question? 

Mr. BITKOWER. I am aware of those facts, yes. 

Ms. DELBENE. So, you have indicated that DOJ’s position is that 

in all cases, the Electronic Communications Privacy Act as written 

reaches data oversees. So where it is stored does not matter. 
41 

Mr. BITKOWER. With respect to the government’s ability to compel a provider to disclose information, it does not matter where the 

provider chooses to store that information, that is correct. 

Ms. DELBENE. Now, you know, Congress is looking at a number 

of ways to update the Electronic Communications Privacy Act to 

account for the global nature of cloud computing, and the needs of 

law enforcement to access critical evidence, but some of the threshold questions that we have discussed include the citizenship of the 

account holder, the location of the data, or the headquarters of the 

company holding the data. Would you say that the DOJ’s position 

is that ECPA as written already addresses questions about how to 

handle data stored abroad, and that all these questions are essentially superfluous to—and we should not be asking them? 

Mr. BITKOWER. So I think ECPA today currently does not make 

distinctions that restrict the government’s ability to investigate 

based on the nationality of the account holder, and does not make 

distinctions about the DOJ’s ability to investigate based on where 

the data is stored. We think that is a wise course to continue with, 

because there are many investigations where we need to take action where the individual may be abroad and the individual may 

not be an American. So obviously we are concerned with legislation 

that would unilaterally strip our authority to investigate in those 

cases. 

Ms. DELBENE. So if we follow the model that says it is based on 

a company, then—and I think this was mentioned earlier as well— 

China could make subsidiaries of Chinese companies in the U.S., 

turn over whatever information it wants, is that a desirable outcome? 

Mr. BITKOWER. That is certainly not a desirable outcome, and 

that is in fact why we are looking for a creative way forward that 

would address conflicts of laws in targeted ways that lower those 

conflicts in case we have legitimate requests from companies that 

respect—countries that respect rights. But we can pick and choose 

which country to make a deal with. 

Ms. DELBENE. So, many of us would agree though that the 

MLAT system is in need of modernization to function officially in 

a digital age. Could you share with the Committee how many times 

an MLAT has been used to obtain data stored overseas versus a 

warrant stored under the Stored Communications Act? 

Mr. BITKOWER. So it is difficult to answer that question, because 

for the most part, if you are talking about the context of the SCA, 

the government is not aware where the data is stored. So if a company complies with an SCA warrant, we will not know one way or 

the other where the company got that data from, Seattle, San 

Francisco, or Ireland. So I cannot give you an answer to that question. I can only give you answers based on the information we have 

received from companies when we serve that process on them. 

Ms. DELBENE. But can you give us your best estimation of that 

answer then? Or is that a different—— 

Mr. BITKOWER. So this may not be a scientific answer, but to our 

knowledge, in the history of serving SCA warrants on U.S. providers, we have never been told that they cannot comply because 

of the conflict of law. 
42 

Ms. DELBENE. It is my understanding that before the Microsoft 

Ireland case, standard practice in these circumstances was to use 

the MLAT process. So if the MLAT process is broken, it is—you 

know, I would urge the DOJ to start working with Congress on reforms, rather than coming up with new legal theories that apparently you have relied on in the past to get there, and I really would 

love to get more information on the difference of these numbers, if 

you can provide those to us. 

Mr. BITKOWER. So we would be happy to work with you on that. 

I guess the one area where I think that it is important to clarify, 

is that there was no change in DOJ policy for—or in the law. For 

upwards of three decades, it has been the clear law of the United 

States that lawful process served under an American company cannot require that company to bring data back from abroad. 

We have never heard from an SCA provider to my knowledge 

that they cannot comply with one of those warrants because of a 

conflict of law. If we were ever told so in a given situation, we 

would take that very seriously. We would work with a provider and 

endeavor to see what that conflict of law is. If there is a true conflict, we would try to see if there are ways around that. That situation has not actually occurred yet, including in the Microsoft Ireland case, whereas I said before, Microsoft has not alleged any conflict of law. In fact, Microsoft submitted a declaration on behalf of 

itself, and Ireland submitted a declaration on behalf of itself, and 

neither one have alleged a conflict of law in that situation. 

So we take very seriously conflict of laws, we do it across a variety of investigative contexts. Nearly every one of our financial investigations involving banks and the like involve claims with conflicts of laws. We work through those processes. If we do proceed 

to a compulsion action in court, the court is then empowered to balance important considerations, including comity, including the 

value to the investigation, including the burden that might be facing the company, and we take all of those very seriously. 

Our concern is with legislation that in every single case, if there 

was a conflict, resolve that conflict against law enforcement and in 

favor of the foreign country. 

Ms. DELBENE. My time has expired. I think we need laws that 

work the way the world works today, and that is going to be critical for us all to follow up on. Thank you. I yield back. 

Mr. MARINO. Thank you. I now my recognize myself for my questioning, and thank you for being here, sir. Assume that I am back 

down near in my position where the Marino thing is, and the gentleman to my left, Trey Gowdy, former Assistant U.S. Attorney. 

The gentleman to my right, the former judge from Texas, Judge 

Poe and myself. And I am going to include you in this because you 

would not be where you are at if you were not. There is no one in 

this room that is more law enforcement than the four of us in our 

careers, and I thank you for your service to this country in law enforcement and prosecution. I read your statement, thoroughly, and 

I agree with you. 

Your first issue, cross border access. We all know how incredibly 

important that is. Your second issue, current rules governing access to data in other countries. Again, another complicated issue 

that we must deal with, and your third issue of the possible legisla-
43 

tion. While it is not possible legislation from my perspective, it is 

going to be legislation from my perspective. We are talking about 

dealing with 2016 issues based on a 1986 law, ECPA, which we are 

talking about data collection when we did not even—when that law 

was implemented, we barely had these. We did not have this, we 

had such a model that my mother still likes to use, just the flip 

one with the big buttons. 

So let me ask you this, if you would please? You talked about 

treaties, and of course the SCA. Would legislation not make life 

simpler if we got a consensus on the legislation, instead of having 

194 different agreements with countries or referring to a law that 

is, what, 30 years old? 

Mr. BITKOWER. So certainly, sir, we would not contemplate 194 

different agreements. We think this agreement would be available 

to a very small set of countries, at least at the beginning. 

Mr. MARINO. Okay. At least in the beginning. But okay, you start 

out with two countries, and then you go to six, and then you go to 

16, and then you go to 60. These countries are not going anywhere, 

and the electronic age is going to continue to explode. So why not 

have definitive legislation? Do you think that justice should be legislating or interpreting a 1986 law, instead of a 2016 Congress legislating what is important to law enforcement, without tying the 

hands of law enforcement, but also with having a law—a rule of 

law that we can agree on with other countries once we get established here in the legislature. 

Mr. BITKOWER. So I fully agree with you that there is an important role for legislative change here and legislative change would 

absolutely be necessary to enable us to take down these conflicts 

of laws in carefully targeted ways. The way we anticipate it working is that Congress would act by establishing the parameters for 

an agreement, and then we would be able to fit particular countries 

in that agreement if they qualify. 

Mr. MARINO. I do not get that from reading DOJ information. I 

am getting that DOJ does not like the LEADS act. 

Mr. BITKOWER. Well so, to be clear sir, even under the context 

of a bilateral agreement of the type we are discussing in the United 

Kingdom, that sort of agreement presupposes both the United 

States and for the United Kingdom the ability to compel the production of data that might be stored abroad. 

Mr. MARINO. My point exactly then. Would legislation not simplify that matter? And when you have a direct source of law that 

we could point to when we need to. Let me pose a scenario to you. 

Assume there is a company with a presence in Brazil. One of our 

companies, a presence in Brazil. And the Brazilian Government 

wants some of that information, they issue a warrant, but that 

warrant would violate U.S. law. What do we do? 

Mr. BITKOWER. That is a serious situation of course. That is one 

we face in real life. That is not a hypothetical situation. 

Mr. MARINO. Okay. But would legislation not then address that 

issue? Good concise legislation working closely with justice and the 

private sector from a law enforcement perspective. Would that not 

be the approach to take? 

Mr. BITKOWER. Yes. I do not want to speak to any particular 

country obviously, because there is a wide variety of—— 
44 

Mr. MARINO. Neither do I. That is why I keep going back to legislation. And it is Congress’ role to legislate. And looking back at a 

30-year law based on where we are today, I do not think is logical. 

So at no time I do not think, at least I do not know that Justice 

even called my office, called Ms. DelBene’s office, called the Chairman to discuss LEADS. We would like to do that; we want input 

from Justice on these issues. 

So again, I thank you for your service, but the point I want to 

get across is Congress legislates, and I yield back my time. The 

Chair now recognizes Congressman Jeffries from New York. 

Mr. JEFFRIES. I thank the Chair for yielding, and for your leadership in putting forth the LEADS Act and on this very important 

issue. And I thank you for your testimony here today. The law is 

currently silent as to whether the DOJ can compel a U.S. company 

to produce the email content of a non-U.S. citizen when the server 

is in another country. Is that correct? 

Mr. BITKOWER. So, we would not agree with that, sir. 

Mr. JEFFRIES. Okay. But the Stored Communication Act is silent 

on this issue, correct? 

Mr. BITKOWER. So, we would agree that the Stored Communication Act does not address that through tax, that is correct. 

Mr. JEFFRIES. Okay. And in light of this silence, the Department 

of Justice has chosen to take the broadest possible interpretation 

as to what its authority can be. Is that right? 

Mr. BITKOWER. Well respectfully sir, there are court decisions on 

the matter, and we are following those decisions. 

Mr. JEFFRIES. Okay. Now do you agree that Congress, in light of 

the silence that you have acknowledged at least as it relates to the 

Stored Communications Act, should step into the void to clarify the 

situation for all parties involved? 

Mr. BITKOWER. So again sir, we think Congress did act, and Congress legislated against a backdrop of which the government could 

compel the production of documents from abroad. So we think that 

already occurred. Obviously we will see how the courts come out 

on these issues, and it may be the case that for the legislation 

might be helpful. 

Mr. JEFFRIES. So at the end of the day, in the absence of congressional action, at least as it relates to the specific circumstance that 

I laid out, is it fair to say that we could put a United States company in the position of providing email content located internationally as it relates to a non-U.S. citizen in violation of another country’s laws. Is that a possibility, sir? 

Mr. BITKOWER. That is a possibility. 

Mr. JEFFRIES. Okay. Now in the 21st century we live in a global 

economy. Is that right? 

Mr. BITKOWER. Yes, sir. 

Mr. JEFFRIES. Okay. And compelling United States companies to 

violate, potentially as you have acknowledged, United States law 

by disclosing email content of non-U.S. citizens could possibly place 

United States businesses at a competitive disadvantage. Is that 

correct? 

Mr. BITKOWER. Sir, the way I would answer that question is to 

say, again, for many decades ,we have engaged in the enforcement 

of our laws, and that often results in us trying to compel records 
45 

from companies which store those records abroad. This is not a new 

issue, it is not unique to the SCA. It is not unique to the United 

States. In fact most countries, or many countries at least, have 

similar provisions in their law that authorize them to seek evidence that may be stored abroad. 

Mr. JEFFRIES. There is at least a possibility that by compelling 

a United States company to violate international law, as you have 

acknowledged, is potentially the case here, that that could place a 

United States company as a competitive disadvantage. Yes or no? 

Mr. BITKOWER. So to be clear, I did not say to violate international law, I said it is possibly the conflict with the law of another country. 

Mr. JEFFRIES. The law of another country. 

Mr. BITKOWER. Yes. 

Mr. JEFFRIES. Correct. 

Mr. BITKOWER. So that is correct. It could absolutely put companies in a situation conflict to legal obligations. 

Mr. JEFFRIES. Okay. Now, and that could in my view I think in 

the view of many reasonable people place them at a competitive 

disadvantage, which I think could undermine the United States’ 

national interest economically. And in fact I would just point out 

that Article I, Section 8, Clause 3 of the United States Constitution 

states that Congress shall have the power to regulate commerce 

with foreign Nations. Are you familiar with that clause? 

Mr. BITKOWER. Yes, sir. 

Mr. JEFFRIES. Now I think that the Founding Fathers in their 

great brilliance understood that Congress should be the entity to 

decide how to properly balance United States’ interests across the 

legal, economic, constitutional spectrum. True? 

Mr. BITKOWER. Congress certainly has that authority, sir. 

Mr. JEFFRIES. So is it not correct that Congress should act in this 

specific circumstance where you have acknowledged at least that 

there is silence? Some ambiguity in order to clarify this very complex situation. 

Mr. BITKOWER. So, again sir, I do not think there is ambiguity 

in terms of how the statute works today. Certainly we do welcome 

the opportunity to work with Congress in addressing the very conflicts of laws you were talking about. Our concern is simply if we 

address them in a way that unilaterally strips U.S. law enforcement authority and does not address the situation of foreign law 

enforcement authority, that is not the approach we are seeking, but 

we do think there is definitely options that Congress can work on 

here. 

Mr. JEFFRIES. Okay. Lastly I would point out, and I think my colleague Darrell Issa began this line of inquiry, I think it was very 

important, the U.S. has a history of respecting the sovereignty of 

other Nations when conducting criminal investigations in the context of extradition treaties. Correct? 

Mr. BITKOWER. Yes, sir. 

Mr. JEFFRIES. And we have got extradition treaties with about 

120 Nations. True? 

Mr. BITKOWER. I do not know the exact number. 

Mr. JEFFRIES. Including Mexico, correct? 

Mr. BITKOWER. That is certainly true. 
46 

Mr. JEFFRIES. Are you familiar with El Chapo? 

Mr. BITKOWER. I am, sir. 

Mr. JEFFRIES. He is an international drug dealer. Correct? 

Mr. BITKOWER. Yes, sir. 

Mr. JEFFRIES. Seven United States jurisdictions have currently 

criminal charges pending against him, including murder. True? 

Mr. BITKOWER. Yes, sir. 

Mr. JEFFRIES. Would you conceive of a circumstance where the 

United States, in violation of its treaty with Mexico, would go 

across the border, snatch El Chapo, and bring him back to justice, 

notwithstanding the serious United States interest? Would you conceive of that circumstance? 

Mr. BITKOWER. No, sir, I could not. 

Mr. JEFFRIES. Okay. And if we would not do it in such a serious 

situation, for the life of me, respectfully, I cannot figure out why 

Congress should not step into this vacuum that exists as it relates 

to email content and respecting the principles of comity and the 

competitive disadvantage that will replace the United States companies and which would undermine our national economic interests. I yield back. 

Mr. MARINO. Thank you. The Chair now recognizes the congressman from Georgia, Mr. Collins. 

Mr. COLLINS. Thank you, Mr. Chairman. I think at this point I 

am just going to have a few questions. But I do not agree with the 

Chairman. I mean, from my background, I think this has become 

the new discussion over the years, as, you know, yes, there are 

many Members who are prosecutors on those, judges on this. I take 

it from a little different perspective. 

I am the son of a State Trooper from Georgia. As I have jokingly 

said, I have fought the law on many occasions, and I lost most of 

the time, but the issue here is not an issue of law enforcement. 

This is an issue of where are we at in 21st century privacy, where 

are we at in a 21st century and digital environment, and why do 

we continue many times to continue to hold to issues that really 

need to be updated? I would agree with my friend from Texas, the 

judge, and I would agree with my friend from New York and also 

Washington. The LEADS Act, although it seems to be in some of 

the questions and some here tends to denigrate this LEADS Act, 

I think that something needs to be done and something that we 

need to put our companies and the world on notice on how we are 

going to do this. 

ECPA also was another issue which is again baffling to me. And 

I know it has been said that well 300 Members could be wrong. 

Well yeah, I agree, this is Congress, but I think 300 Members also 

have a pretty good idea that something is not right too. And to continue to hold this out is a frustration, but especially from DOJ’s position. 

And in the Second Circuit Court of Appeals, I think it is the 

Microsoft case, as we work on this, the DOJ lawyer argued in the 

case that it does not—that ECPA does not apply to disclosure of information abroad. Even if the information to be disclosed is private 

email correspondence of a U.S. citizen. 

In other words, the Department argued that U.S. citizens’ emails 

have no privacy protection under ECPA outside the U.S. They were 
47 

pressed on this issue by the court, and the court—the DOJ attorney said the result should be of some concern to U.S. technology 

users, but suggests this is the norm, was his words. Or their words. 

I am concerned about the Department’s position. I reject this notion that this is the new norm, and in fact, I think Congress is 

speaking in to say Congress the silence on this is not accurate in 

this environment. But I just want a clarification. 

Do you agree that ECPA does not provide or protect email communications even if sent and received within the U.S. from disclosures abroad? 

Mr. BITKOWER. Thank you, Congressman. So I think it is important to distinguish between two different provisions of ECPA. The 

provisions at issue in the Microsoft case generally are the provisions in 2703, which relate to the United States government’s authority to compel a provider that is already subject to our jurisdiction to compel records that are in its custody or control. The provisions I think you are talking about now are the ones contained in 

2702, which prevent a provider from disclosing content except in 

certain limited circumstances. 

Mr. COLLINS. Well, let’s go there, because there is a concern 

there, because what it seems to be, and again, you—it is your time 

to clarify. It seems that what the Department of Justice is not seeing is that they are trading private emails of technology users as 

a business record of a service provider. That is a leap. 

Mr. BITKOWER. So, certainly, sir, that is not the standard that we 

are applying. The standard we are applying when it relates to our 

ability to compel—— 

Mr. COLLINS. But you have taken that position in litigation. 

Mr. BITKOWER. No, that is not precisely correct, sir. 

Mr. COLLINS. Okay. Elaborate. 

Mr. BITKOWER. I would be happy to clarify, sir. So, the precedent 

we have taken is that a long line of cases stretching back over 30 

years allows us to compel companies that are subject to our jurisdiction to produce responsive materials pursuant to lawful process, 

even if they may be stored abroad. Now if that production produces 

a conflict of laws, there is further work to be done. There is further 

work to be done both by us in discussing it with the company and 

by the courts if applicable. 

The question I think that you are raising now about whether a 

company is free to disclose information is a slightly separate question. And that is if a company, American or otherwise, stores data 

abroad, then the protections of 2702 may not apply. That is, that 

company, irrespective of what DOJ does one way or the other, may 

be free to disclose that information to a foreign government or to 

any other person. The provisions of ECPA have simply been interpreted not to apply as it regards to 2702, which protects the information. 

Mr. COLLINS. I think at this point in time, in the effort to defend 

the what if, I think DOJ has had some contorted positions in this. 

And I think understandably you have a job to do, you feel this is 

the best way to do your job. I think this panel, if you have heard 

today, has some very different opinions on how that actually is 

playing out in the real world, dealing not only with businesses and 

the cross country data flows and other issues, but also just the 
48 

issues of privacy and the issues of when this is. And again, when 

you get that to a point of, you know, whether the company can disclose or not, and it being a business record of a company which has 

nothing, there is some concern there. 

So we are going to continue this hearing, I appreciate your service, but the LEADS Act and ECPA need to move forward, and this 

needs to be—have a debate. It is not up to an executive agency to 

determine law or intent. It is up to this Congress to do so. We are 

doing that, and I think that is where it needs to go. And with that 

Mr. Chairman, I yield back. 

Mr. MARINO. Chair recognizes Congresswoman Jackson Lee from 

Texas. 

Ms. JACKSON LEE. Thank you very much. I was very pleased to 

listen to a sizeable part of the exchange, and Mr. Bitkower, I thank 

you for your service representing this Nation and the Department 

of Justice. But as I listen to the series of back and forth, I think 

one of the things that I want to restate for the record is the large 

gap of response by Congress, in particular the passage of the Electronic Communication Privacy Act in 1986. 

I guess I am in awe, and I might use the term appalled, that 

there is that large, enormous gap that has lasted on a number of 

issues. Then a state for the record that the SCA was not designed 

for international application, and ECPA does not permit providers 

to disclose information directly to a foreign law enforcement agency, even when the agency is investigating one of its own citizens. 

I think we had as an example what a police officer would do, 20 

years ago in the United Kingdom, what they might need to do now, 

which is to ask for the information. 

I also want to put into the record the dilemma that Microsoft 

faced. Their case is now pending. They answered part of it, Microsoft produced a non-content information. But they made the argument I think legitimately when the other material was stored in 

Dublin, Ireland. And so we find ourselves in a dilemma that must 

be answered. And what I would like to see is that we answer it 

with DOJ, even as we move legislation forward. 

And so I am going to ask process questions, and what you are 

seeing in the day-to-day operations of the Department of Justice. 

So I will just ask the question. One, is it obvious that you are seeing a massive increase of requests for data internationally? 

Mr. BITKOWER. Thank you, Congresswoman. We are seeing a 

massive increase of requests for—— 

Ms. JACKSON LEE. Well if massive takes you back, you are seeing 

an increase in requests coming in. 

Mr. BITKOWER. I would say massive, Congresswoman. 

Ms. JACKSON LEE. All right. I had the right—— 

Mr. BITKOWER. We have seen a massive increase in this, particularly for digital evidence. 

Ms. JACKSON LEE. And as I see, part of the process in particular, 

some of the processes under the DOJ requires a request to come 

into the international office, and then it gets spread out to U.S. attorneys across the Nation. Already I am overwhelmed by just the 

process of it having to leave you, headquarters, and reach to places 

beyond and find offices of varying sizes that have to respond. 
49 

So let me just get a more detailed response from you. Do foreign 

law enforcement officers ever attempt to obtain data through faster, informal channels? Do they call their colleagues in the FBI or 

the NSA for a faster result? 

Mr. BITKOWER. So there are a range of methods of international 

cooperation. Each one of them must obviously follow the law, but 

certainly there are occasions where we can share information on a 

more informal basis. If consistent with the law, of course. 

Ms. JACKSON LEE. The question implied that maybe there was 

the normal collegiate responses, and so you cannot attest here 

today that that does not happen. I hear what you are saying, in 

compliance with the law, but—— 

Mr. BITKOWER. That is correct. 

Ms. JACKSON LEE [continuing]. Because the law is so—I would 

say it does not answer the questions, it could be possible that relationships and people’s interpretation of the law, information could 

just be given or access could be given. 

Mr. BITKOWER. Well again, certainly Congresswoman, information relating to law enforcement threats is shared every day by police forces around the world. When it comes to compelling data 

from a provider, then there needs to be a legal process, and that 

legal process has to be obtained either under the law of the United 

States pursuant to if it is content a probable cause standard, or if 

under the law of a foreign jurisdiction. What we are trying to do 

here is eliminate some of the obstacles and burdens that are created when one country has to go through the processes of another 

country in order to get that information. 

Ms. JACKSON LEE. And particularly when it involves the providers. Let me ask, one of the chief concerns underlying this discussion is the move toward data localization laws in other countries. 

And so, would you explain why the current environment has motivated some countries to try to balkanize the internet in this way, 

with respect to the data localization? 

Mr. BITKOWER. Yes, thank you very much. So one of the concerns 

we have seen with regard to the new world of cloud computing and 

international data storage is that countries make requests that 

may be legitimate under their own laws for data that happens to 

be stored in another country, perhaps in the United States. If they 

cannot get those requests fulfilled in an efficient manner under 

their own law, then there is an incentive for them to mandate that 

that data be stored in their own country, so they do not have to 

go through these cumbersome processes, whether it is with U.S. or 

another country. 

So one of the goals of the framework we are discussing today is 

to try to eliminate those incentives, but in a very carefully targeted 

way that protects privacy and civil liberties, and only for countries 

with an established rule of law system. 

Ms. JACKSON LEE. Would you say that legitimate major companies, many of them creating genius through intellectual property, 

created here in the United States, become the tennis ball, the batting ball, and they become batted from one place to another? I hesitate to say that they are victims, but in essence, are they batted 

from one place to the next under the present structure that we now 

have? 
50 

Mr. GOODLATTE. The time of the gentlewoman has expired, but 

the witness will be permitted to answer the question. 

Mr. BITKOWER. Thank you. So yes, in particular, the requests by 

foreign countries for data stored within the United States, that is 

correct. 

Ms. JACKSON LEE. And so we need a fix. 

Mr. GOODLATTE. The gentlewoman’s time has expired. 

Ms. JACKSON LEE. I yield back, thank you, Mr. Chairman. 

Mr. GOODLATTE. The Chair recognizes the gentleman from Colorado, Mr. Buck, for 5 minutes. 

Mr. BUCK. Thank you, Mr. Chairman. Mr. Bitkower, I assume 

that as a United States citizen, you would agree with me that I am 

afforded certain protections by our Constitution and laws. 

Mr. BITKOWER. That is correct, sir. 

Mr. BUCK. And that an individual in Ireland would be also afforded certain protections by their laws? 

Mr. BITKOWER. Yes sir. 

Mr. BUCK. And we have a treaty between the United States and 

the United Kingdom that recognizes those protections, and both 

countries agreed to. 

Mr. BITKOWER. Both the United Kingdom and with Ireland, yes 

sir. Separate treaties. 

Mr. BUCK. Excuse me. And when the Department of Justice goes 

around that treaty, you have made a decision that—and I assume 

it is fair to say that you went around the treaty by getting information in the Microsoft case outside of the processes created by that 

treaty. 

Mr. BITKOWER. So I would actually disagree with that, sir. The 

treaty between the United States and Ireland, first of all—let me 

back up. At the time the request was made in the Microsoft case, 

the Department of Justice had no knowledge that the data was 

stored in Ireland. Typically we would not be aware of that information unless we were told by the provider after it happens. 

Mr. BUCK. Did you withdraw your request when you learned that 

the information was stored in Ireland? 

Mr. BITKOWER. So that brings me to the second point, sir, which 

is that many mutual legal systems treaties do not require that they 

are the exclusive mechanism for getting data from one country to 

another. They are one option. 

Mr. BUCK. Well, is there a just kidding clause in that treaty? Is 

there something in the treaty that says, ‘‘Well you do not really 

have to follow the treaty? You can do anything you want, this is 

just one way of getting information.’’ 

Mr. BITKOWER. Well, so in essence, sir, the treaty does state as 

one way of getting information necessary. It is not the only way of 

getting information. 

Mr. BUCK. And so, does the Department of Justice recognize the 

situation you have put American corporations in across the world 

when you go around treaties and use a completely separate process? Why would any country want to do business with an American 

corporation if America has access to that information all across the 

world? 
51 

Mr. BITKOWER. So again sir, I have to emphasize that we do not 

go around treaties if those treaties do not require that they have 

the present mechanism. 

Mr. BUCK. You said you used a different process to get information. 

Mr. BITKOWER. That is correct. That is correct. 

Mr. BUCK. Now that is not going around the treaty? 

Mr. BITKOWER. It is not, sir. The treaty does not require that it 

be the exclusive mechanism for the transfer of data. 

Mr. BUCK. So answer my question. Do you recognize the situation you have put American corporations in across the world? 

Mr. BITKOWER. So if our actions did create a true conflict of laws, 

we would recognize that as a serious problem, yes sir. 

Mr. BUCK. I did not ask about conflict of law. We are trying to 

do business with other countries. And if the Department of Justice 

has a way of going around a treaty and getting information from 

an American corporation for an Irish citizen on an Irish server, 

why would any country want to do business or any citizens of any 

country want to do business with American corporations? 

Mr. BITKOWER. So again sir, I need to specify. The discussion in 

terms of the Microsoft case did not necessarily involve an Irish citizen or a person in Ireland. It is data that happens to be stored 

in Ireland. It could belong to—as far as the record is clear, a citizen 

of any country, including an American citizen. That is said, the 

only fact we know about it from the record of that case is that the 

company has chosen to store that information in Ireland. 

If, for example, it belongs to an American citizen, or a citizen 

committing a crime who is located in America, I think we would 

all agree that the United States has legitimate interest in obtaining that information as expeditiously as possible so long as it follows—— 

Mr. BUCK. Are you going to answer my question? Why would an 

American company—why would anybody want to do business with 

an American company overseas if the United States has access to 

any information it so chooses by going around a treaty? 

Mr. BITKOWER. So again, sir, if there is a conflict of laws, we 

would take that seriously. And if that is brought to our attention, 

we absolutely will do everything we can to avoid a—— 

Mr. BUCK. I am not talking about the laws, though. I am talking 

about the competitive disadvantage you are placing American companies in. 

Mr. BITKOWER. So my understanding is of what we have heard 

from companies is certainly the competitive disadvantage, if any, 

comes from the fact that they are placed in conflicting legal obligations. That is one country tells them to do one thing, another tells 

them to do another. If that comes to our attention, we take it seriously, and American law already also takes that seriously. 

The situation we are talking about now is, however, where data 

may be stored in a country with no connection to that country 

other than the fact that it is chosen to be stored there. It could be 

the information of vital importance to the United States, and information with very little connection to Ireland. And in that case, we 

just need to have a mechanism to make sure we can get that data 

to the United States to protect American citizens. 
52 

If it turns out there is a conflict of law at any point, if that is 

brought to our attention by the company or by the country itself, 

then obviously we would have further work to do and further discussions to be had. I want to clarify, that has not happened in the 

Microsoft case. 

Mr. BUCK. If Microsoft is put in a position where—or any American company—and frankly what is most bothersome to me is 

Microsoft has the resources to battle with the Department of Justice. A startup company, a company with 10, 12 employees in a 

similar situation would just cave. The coercive effect of the government would be placed on a company like that, and they could not— 

they do not have the resources to fight the Department of Justice. 

But in this situation, a foreign citizen would not want to do business with a U.S. company if that U.S. company is forced by the 

U.S. Government to turn over information that is located in that 

foreign country. And I am concerned about that. 

Mr. BITKOWER. So again sir, that is the very purpose of the U.S.- 

U.K. framework that we are trying to explore now, is to find the 

ways of eliminating those conflicts of laws, prevent any competitive 

disadvantage to our companies, but do it in a careful way that allows the different investigations to take place, both on our behalf 

and on behalf of foreign governments in a way that it respects privacy. 

Mr. BUCK. I yield back, thank you, Mr. Chairman. 

Mr. GOODLATTE. The gentlewoman from California, Ms. Chu, is 

recognized for 5 minutes. 

Ms. CHU. Mr. Bitkower, the process to exchange data under the 

MLAT process has been criticized as being slow and cumbersome, 

with requests taking average 10 months to fulfill. You argue that 

the MLAT is also unreliable, given that our country does not have 

MLATs with about half of the countries in the world. And some 

countries exclude certain categories, or do not cooperate at all. Is 

this occurring because they believe the MLAT process is too slow, 

or do they not believe in this process at all? 

Mr. BITKOWER. So again, the MLAT process faces a variety of 

challenges. You have identified some of them. That is, even if we 

have a fully functioning MLAT relationship with another country, 

it will take many months at best to get that information. And as 

you point out, we may never get it at all, and that is even when 

we have a treaty, and as you point out again, for about half the 

world, we do not even have such a treaty, so in those cases, the 

requirement to rely exclusively on MLAT channels would end investigations. 

Ms. CHU. Well, you have referred to the proposed deal between 

the U.S. and the U.K., and providers under this deal could disclose 

data directly to the U.K. for serious criminal and national security 

investigations when the U.K. obtains authorization to access the 

data under its own legal system. While the courts may have provisions to protect individuals’ privacy rights, other countries may not. 

If we use the U.K. agreement as a model, what steps will the Department of Justice take to ensure that there are sufficient protections for privacy and civil liberties moving forward? 

Mr. BITKOWER. Thank you Congresswoman. So that is an area 

where we would hope to work very closely with Congress in setting 
53 

up exactly what those adequate baselines are for protecting privacy 

and for protecting civil liberties, and we want to make sure that 

any country we choose to negotiate an agreement with fits into that 

category based on its own legal framework. It does not require that 

it exactly mirror the American framework certainly, and if it did 

require it, then no country would quality, but it does require that 

the country have those adequate protections. 

Ms. CHU. And what kind of enforcement mechanisms could you 

put in place to ensure that that they would comply with, with privacy terms as well as other terms of the bilateral agreement? 

Mr. BITKOWER. So again, we are obviously at the early stages of 

discussing what these agreements would look like and what the 

legislation would look like. We would certainly anticipate that 

there would have to be a mechanism to provide oversight of the 

agreement to make sure that it is being applied correctly. 

Ms. CHU. And if the bilateral agreement approach is taken by 

the U.S., how do we determine whether or not a country is an appropriate partner? For example, how many of the witnesses have 

discussed about a country’s policy on human rights. How do we 

evaluate that consideration and whether the country meets that requirement? 

Mr. BITKOWER. So that would be a topic for close and ongoing 

conversation, I think, between us and Congress certainly. There 

are a number of factors we would look at. We would look at the 

system as a whole certainly, but with particular regard to its surveillance laws. We would want to make sure that there is a rule 

of law framework in place and appropriate procedural and substantive protections for privacy and civil liberties. 

And these are areas of course, it is easier in cases like the U.K. 

where it is a longtime ally with a long democratic tradition with 

whom we have actually had a very long MLAT relationship as well. 

So we have a certain knowledge and visibility about how their system works, and I think that would be helpful in the process. 

Ms. CHU. And with a country that is not as clear as the U.K., 

what would you do? 

Mr. BITKOWER. So a country that is not as clear as the U.K. 

might not qualify at the end of the day, and that is just a fact. So 

we would have to make sure that the country, whatever its laws 

are, that we get good visibility into what those laws are. Not just 

what the laws are on the books, but how they are applied in practice, and to make sure there are those appropriate protections in 

place before we would consider such an agreement. 

Ms. CHU. Okay. Thank you. I yield back. 

Mr. GOODLATTE. The Chair recognizes the gentleman from Rhode 

Island, Mr. Cicilline, for 5 minutes. 

Mr. CICILLINE. Thank you Mr. Chairman. Thank you, Mr. 

Bitkower. I want to just pick up on something you just said. You 

said in your testimony that the MLAT is not the only way of getting information. It is not the exclusive way. I just want to challenge you on that for a moment. It is in fact the agreement by 

which we set out a procedure for the sharing of information. That 

is the purpose of the treaty. 

Mr. BITKOWER. So all MLATs are different, and some of them 

have different provisions, but MLATs are generally one method of 
54 

exchanging information. They are not typically the exclusive mechanism. 

Mr. CICILLINE. But I mean, is not the purpose of the treaty so 

that both parties to a treaty have an understanding about a process that will be followed for a particular activity? And that is the 

whole purpose of it, otherwise what would be the purpose of having 

an MLAT if it were not in fact the expectation of both parties that 

this process be followed in the sharing of information? 

Mr. BITKOWER. Well, so again, sir, every treaty is different. Typically the treaties make sure that a process is available to be followed in the case of a need in the requesting country. 

Mr. CICILLINE. And with respect to the negotiations with the 

United Kingdom, what is the exact status of that negotiation, and 

what action will be required by Congress according to you, if any, 

if that agreement is successfully concluded? 

Mr. BITKOWER. So, thank you, sir. The negotiations began, I 

think as you know, fairly recently, where we received formal authority to begin those negotiations within the last month or so. We 

have been hard at work in seeing what an agreement would look 

like, but we absolutely recognize that action by Congress would be 

necessary to make this project feasible in the first instance, both 

to lower in a targeted fashion the legislative bars that are present 

in our own law, and also to set up the framework to determine 

which countries would be eligible to join such an agreement. 

Mr. CICILLINE. And so, to use this example again of British law. 

As you know, British law is not always compatible with U.S. law, 

particularly in the areas of due process and probable cause determinations. And if you think about the requirements we have in this 

country in terms of judicial review, a concept which is not omnipresent in the British system, how do you square some of those 

standards and practices? And that is a country that I think most 

people would agree might have more compatibility than many 

other countries. How do you make those determinations so that we 

can be certain those very deeply held values are reflected in this 

process? 

Mr. BITKOWER. So I think that is the key question, and it is one 

that we will be grappling as we go forward. I think it is important 

on the one hand that we do not require that the other countries’ 

legal processes exactly mirror our own, or else no country would 

ever qualify of course. We have some of the highest privacy protections in the world, and we are proud of those, and justifiably so, 

and we want to make sure that other countries have substantial 

protections and legitimate protections, but we cannot demand that 

they have the exact same legal standards for every sort of process 

along the way. Some of them have lower standards in one area and 

higher standards in another, and they have their own checks and 

balances within their own system. 

So the U.K. is a country with which we have a great familiarity. 

As I said before, a very long democratic tradition, a tradition of 

rule of law. We are comfortable with understanding how their system works. As I mentioned earlier, they have also introduced a new 

investigative powers bill which would introduce further reforms. So 

we will have to keep looking at that as it goes forward. We will 

make any evaluation at the time when the legislation is prepared. 
55 

Mr. CICILLINE. But Mr. Bitkower, I think it is very clear that 

most of us on the Committee recognize that there is an important 

role for Congress to play in this. And if you have already answered 

this, I apologize, but it seems particularly disturbing that in light 

of the complicated nature of this and the important role of Congress should be playing that many of us learned about this from 

reading it in a news account. And I am just wondering, what was 

the reason that you would not have engaged Congress more as you 

developed or thought about the development of framework, so that 

we might have some alignment of what ultimately Congress might 

intend to do in this area? 

Mr. BITKOWER. So again sir, I want to make clear that we only 

very recently began negotiations with the U.K., and only very recently, in fact, we received permission to do so through the intergovernmental process. So we tried to notify this Committee as soon 

as we possible could once those negotiations started. It was approximately the same exact week, I believe, that the Washington 

Post article came out. 

We have tried to make ourselves available to brief this Committee and others. We expect to continue to do so, and there is no 

question that we fully respect the essential role that Congress has 

to play in these agreements. 

Mr. CICILLINE. Thank you. I yield back. 

Mr. GOODLATTE. The Chair thanks the gentleman. The gentleman from California, Mr. Peters, is recognized for 5 minutes. 

Mr. PETERS. Thank you, Mr. Chairman. I want to thank you, sir, 

for your patience and for hanging in there. I think you have answered the questions very clearly. As I understand it, you are following the law as was passed in 1986 and interpreted by the 

courts. I am not sure what else we would ask you to do. You have 

been admonished or exhorted by a number of Members of Congress, 

that Congress should act. 

I am not sure what you are supposed to do about that either. 

These are all Members of Congress, maybe they are responsible for 

amending the laws if we see a need to do so, but I appreciate how 

you have illuminated the issues. But it was a little bit Alice in 

Wonderland-y to hear them lecturing you about why Congress 

should take some action, because they are Congress Members. 

But I would say your testimony spells out pretty long detail of 

some concerns about the LEADS Act. I apologize, I do not have the 

testimony that you refer—cross reference about the ECPA amendments that are proposed, but maybe you could just take a few minutes to sort of outline what your main issues are. And then I would 

like to know kind of how you think it would be most constructive 

given the discussion we have had about the negotiations with Britain, that this Committee might engage you in talking through some 

of those issues so that we could actually update the law to reflect 

not both privacy concerns—both privacy concerns as they are 30 

years on, but also security concerns. 

Mr. BITKOWER. So thank you, Congressman. I will begin with the 

ECPA related proposals, and I am concerning to make sure you get 

a copy of the testimony we submitted in connection with that hearing. But as we have said in that testimony and elsewhere, the Department absolutely recognizes that some of the provisions of 
56 

ECPA have not kept pace with the way technology is used today, 

and the way people think of their emails. 

And we are certainly open to a change that would require a warrant when criminal law enforcement authorities seek to compel the 

content of emails, whether they are older than 180 degrees, newer 

than 180 degrees, whether they have been opened, whether they 

have not been opened. We are certainly open to that change. We 

do have a concern that any change in law create an accommodation 

for certain very limited civil investigative functions where a warrant is simply not available, because they are not criminal investigators. 

Mr. PETERS. That would be something of the SEC for instance. 

Mr. BITKOWER. The SEC, I am talking about important civil 

rights investigations, anti-trust investigations. Things that affect 

important rights for Americans every day. We have a number of 

other concerns with the Email Privacy Act, which we are happy to 

provide further information on, but we do have some concerns. 

For example, in the area where it permits us to obtain records 

from a corporation, where a corporation provides email to its employees, there needs to be a mechanism and a functional mechanism where you can get those emails. Traditionally we do those investigations by subpoena, because traditionally the employees do 

not have privacy rights in those emails, and we want to make sure 

that provision works well. And there were a couple of other areas 

where the bill gives us some concerns. But we are happy to work 

with this Committee and others in making those understood. 

Mr. PETERS. Have you been in conversation with Committee staff 

about these issues? 

Mr. BITKOWER. We certainly have, sir. 

Mr. PETERS. Okay. Well I appreciate that. And I thank you again 

for your time. I am looking forward to the second panel. And I yield 

back. 

Mr. BITKOWER. Thank you. 

Mr. GOODLATTE. I thank the gentleman. Mr. Bitkower, we very 

much appreciate your testimony here this morning, and we can excuse you at this time, and we will go to our second panel. 

Mr. BITKOWER. Thank you very much. 

Mr. GOODLATTE. We now welcome our second panel of distinguished witnesses today, and if you would all please rise up, I will 

begin by swearing you in. Please raise your right hand. Do you and 

each of you swear that the testimony that you are about to give 

shall be the truth, the whole truth and nothing but the truth, so 

help you God? Thank you very much. 

Let us let the record reflect that all of the witnesses have responded in the affirmative. And we will begin our introductions by 

recognizing the gentlewoman from Washington for the purpose of 

introducing Mr. Smith. 

Ms. DELBENE. Thank you Mr. Chair. It is my pleasure to welcome Brad Smith as a witness today. Brad serves as the president 

and chief legal officer at Microsoft, and had joined Microsoft in 

1993 and became general counsel in 2002 and then was made 

president and chief legal officer just last summer. He is responsible 

for the company’s corporate external and legal affairs, and he is a 

graduate of Princeton University and the Columbia University 
57 

School of Law. And it is great to have someone here from Washington State and we just want to welcome you and thank you for 

being here. I yield back. 

Mr. GOODLATTE. Welcome. Our next witness is the Honorable Michael Chertoff. He is the executive chairman and co-founder of the 

Chertoff Group. From 2005 to 2009, Mr. Chertoff served as Secretary of the Department of Homeland Security. Federal judge of 

the U.S. Court of Appeals for the Third Circuit and Assistant Attorney General of the Department of Justice, Criminal Division. 

Mr. Chertoff is a graduate of Harvard College and Harvard Law 

School. 

Our next witness, the Honorable David Kris, began his career 

with the U.S. Department of Justice serving as an attorney in the 

criminal division and then as Associate Deputy Attorney General. 

He went on to be deputy general counsel and chief ethics and compliance officer at Time Warner, Incorporated, as well as an adjunct 

professor of law at Georgetown University and a non-resident senior fellow at the Brookings Institution. Mr. Kris currently teaches 

national security law at the University of Washington Law School, 

and he is a graduate of Haverford College and Harvard Law 

School. Harvard Law School is well represented here. 

Our final witness is Ms. Jennifer Daskal. Ms. Daskal is an associate professor of law at American University, Washington College 

of Law where she teaches and writes in the fields of criminal law, 

national security law and constitutional law. From 2009 to 2011, 

Ms. Daskal was counsel to the Assistant Attorney General for National Security at the Department of Justice and among other 

things, served as the Secretary of Defense and Attorney Generalled Detention Policy Task Force. Prior to joining the Department 

of Justice, she was the senior counter-terrorism counsel at Human 

Rights Watch and worked as a staff attorney for the Public Defender’s Service for the District of Columbia. She earned a bachelor’s 

degree from Brown University, a master’s degree from Cambridge 

University and not surprisingly, a J.D. from Harvard Law School. 

We welcome all of you. Your written statements will be entered 

into the record in their entirety and I ask that each of you summarize your testimony in 5 minutes or less. To help you stay within 

that time, there is a timing light at the table. When the light 

switches from green to yellow, you have 1 minute to conclude your 

testimony. When the light turns red, that is it. You are done. 

Mr. Smith, welcome. We are pleased to have you here, and you 

may begin the testimony. 

TESTIMONY OF BRAD SMITH, PRESIDENT AND CHIEF LEGAL 

OFFICER, MICROSOFT CORPORATION 

Mr. SMITH. Chairman Goodlatte, Ranking Member Conyers, 

Members of the Committee, it is my pleasure to represent Microsoft this morning. Today’s hearing provides an important opportunity to address a critical issue—the growing conflict between 

countries and among laws that are affecting not only technology, 

but people’s safety and privacy. I think the ramifications of this 

issue are really illustrated by two real-world examples. 

The first is a case involving Microsoft a year ago in Paris. The 

day after the horrific terrorist attack on Charlie Hebdo, the French 
58 

police using international legal process worked with the FBI and 

served on Microsoft lawful requests seeking the emails of the two 

terrorists that were at large in the streets of France. Because the 

French used international legal process, we at Microsoft were able 

to examine the orders, determine they were valid, pull the email 

and provide them to the FBI and the French all in exactly 45 minutes. That was a day when the system worked. But unfortunately, 

that has become the exception, not the norm. The norm is illustrated by the second example. A case involving Microsoft in Brazil; 

there, the Brazilian police have in pursuit of a local suspect served 

a local order requiring Microsoft to turn over content that is not 

in Brazil, but is in the United States. And because U.S. law prohibits us from turning over some of this content, Microsoft has had 

to refuse. The Brazilians have not turned to international process. 

They have not obtained the information they need, but they have 

fined Microsoft, and they are pursuing a criminal prosecution of 

one of our executives in Brazil for the sole reason that we are comply with United States law. 

And unfortunately, that kind of case is spreading. It is spreading 

because other governments, including the United States government is using unilateral legal process rather than international 

legal process to obtain data around the world. Now, we appreciate 

that law enforcement needs information, sometimes located in 

other countries to do its job, but this approach to using unilateral 

process is causing concern around the world. It is causing concern 

in other countries about people’s privacy rights. It is causing concern about whether other countries can even trust and use American products and technology. It is causing concern that is leading 

other countries to enact new laws to block the very steps that our 

government typically takes through unilateral search warrants. 

Now, the good news is there are solutions at hand. There is a solution in the form of Federal legislation modeled on something like 

the LEADS Act. There is a solution in the form of modernization 

of the mutual legal assistance treaties. There is a solution in the 

form of new international agreements that are designed and built 

for the 21st century. Like the one that is now being considered between the U.S. and the U.K. All of this will require action across 

the executive branch, but it requires action by Congress as well because all of these problems have a root cause. Our law is old and 

has become outdated. 

When Congress passed the Electronic Communications Privacy 

Act, when the House passed that bill by voice vote on June the 

23rd, 1986, Ronald Reagan was president, Tip O’Neill was speaker, 

and Mark Zuckerberg was 2 years old. In the 30 years that have 

followed, 125 million new Americans have been born. Technology 

has moved ahead by leaps and bounds, but at least in this field, 

the law has mostly stood still. I have here on one hand, and IBM 

computer that was first sold in 1986, and I have here on the other 

hand, a Microsoft Surface that is for sale today. The computer that 

is for sale today not only connects to all of the world’s information 

on the internet, it has 355,000 times as much storage capacity as 

the floppy diskette that one had to use in this computer that was 

sold when ECPA was passed. These two computers make the story 
59 

clear. Technology has moved forward. Now, the law needs to catch 

up. Thank you very much. 

[The prepared statement of Mr. Smith follows:] 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 

Mr. GOODLATTE. Thank you, Mr. Smith. Mr. Chertoff, welcome. 

TESTIMONY OF THE HONORABLE MICHAEL CHERTOFF, COFOUNDER AND EXECUTIVE CHAIRMAN, THE CHERTOFF 

GROUP 

Mr. CHERTOFF. Mr. Chairman, it is good to be back. I am looking 

at that IBM computer. It looks like what I have at home still. I obviously would like to indicate that I am speaking here in a personal 

capacity, although my firm does do work with Microsoft and other 

tech companies in this area, and as I also previously disclosed, I 

am of counsel with Covington and Burling, which is actually involved in representing Microsoft in this litigation. But whatever I 

am saying here really reflects my own views and no one else should 

be held accountable for them. 

I think it is really important that this Committee have this hearing, and that Congress get involved in legislating in this area. The 

issues that surround the intersection between modern technology 

and the law are frankly quite complicated. They are quite technical, and even having been a Federal judge, I have to say I am 

not sure the Federal courts in the first instance are the right place 

to resolve all of the competing issues in technical dimensions of 

these kinds of questions. Now, here, we are dealing with one aspect 

of this, which is as Brad Smith pointed out kind of dramatically— 

the amount of data now which is—moves around the world and is 

held in this so called cloud dwarfs what was being confronted when 

ECPA was passed. And contrary to what maybe some people think, 

obviously when the data is in the cloud, it is not really in the cloud. 

It is living somewhere in the world in a server, and the ability to 

house it anywhere in the world and to move it around rapidly as 

possible really changes the dimensions of the question about where 

something is and who ought to have the jurisdiction to compel it 

to be turned over. 

I think we are seeing the issue of conflict of laws in three areas. 

First substantive areas where different countries in parts of the 

world have different views about what gets protected as private 

and what does not. Second, the question of process—different 

standards of process about what is required when a government 

seeks data, and finally, the problem of global companies that are 

often caught between different legal regimes and are damned if 

they do and damned if they do not. 

And so, I think we do need to take the opportunity to look at 

rationalizing the law and particularly to the extent we can, 

globalizing the law. Coming up with agreements and processes that 

allow us to synchronize the law so that companies that are in the 

business of housing data are not caught between the so-called rock 

and a hard place. And I would suggest as I do in my statement, 

just a couple of points about this. 

First, I think to the extent we can have agreements or frameworks in a statute that lead to agreements, we ought to be focusing 

on the citizenship of the accountholder and not where the data 

happens to be located. Data location should be driven by engineering considerations, and not by desires to create legal safe havens 

or to find places that are legally more or less hospitable. 
73 

The second thing I would say is if we are going to have agreements, we do need to make sure that the companies we are dealing 

with have process in place that is comparable to what we require 

with respect to our own citizens when other countries want to have 

data that is held over here. We do not want to create a situation 

where we are jeopardizing the constitutional rights of our Americans by simply in the pursuit of an agreement. 

And finally, we have to recognize there will be certain types of 

requests from other countries that will run afoul substantive issues 

and so, we are going to have to create a regime—a legal regime in 

place through any agreement and through any statute that respects that. Finally, there has been a lot of discussion about the 

MLAT process and I think, you know, Brad Smith was very clear 

in indicating this process can work if we want it to work. Often, 

frankly, I can speak from my own experience, honoring MLAT requests goes to the bottom of the pile of overworked assistant U.S. 

attorneys, but with modern technology and if the government views 

these as high priority cases, we can move to the kind of process 

that gives you the results that occurred in the Paris case. And 

which I think would encourage both our country and other countries to use the international treaty process rather than unilateral 

action as a way to get information that is stored in other parts of 

the world. 

So, thank you, Mr. Chairman, and I look forward to answering 

questions. 

[The prepared statement of Mr. Chertoff follows:] 
74 
75 
76 
77 
78 
79 
80 

Mr. GOODLATTE. Thank you, Mr. Chertoiff. Mr. Kris, welcome. 

TESTIMONY OF THE HONORABLE DAVID S. KRIS, FORMER ASSISTANT ATTORNEY GENERAL FOR NATIONAL SECURITY, 

UNITED STATES DEPARTMENT OF JUSTICE 

Mr. KRIS. Thank you, Mr. Chairman, Mr. Ranking Member, and 

Members of the Committee for inviting me to testify. I, too, am 

speaking only in my personal capacity. There is obviously a range 

of opinion represented on the Committee today, but I think there 

is also an unusual degree of consensus, which I have heard during 

the course of this morning’s proceedings on at least three important 

points. First, there is a problem. 

We have a situation where there are international conflicts of 

laws in which one government’s laws can compel the production of 

data, while simultaneously, another government’s laws will prohibit it. This is very vexing for the holders of data, like Microsoft, 

who understandably wish to comply with all of the laws and rules 

to which they are subject. Second, this problem is not unprecedented, but it is getting worse over time. I think that is true for 

three technical reasons and three political reasons which I will outline quickly. 

Technically, the size and scope of international data networks, 

the degree of international data storage in the cloud and the use 

of encryption are all on the rise in previous—in recent years. Politically, the Snowden disclosures, I think, have caused the U.S. Government to decrease the scope and increase the transparency of its 

surveillance. That is particularly true in the foreign intelligence 

realm, but there is a good deal of overlap with law enforcement. 

On the other hand, in Europe, the rise of ISIL and some of the 

technical factors that I have mentioned, I think have caused European governments to go the other way to expand their surveillance 

authorities and to put a lot of pressure on providers. And third, the 

providers for their part are a little bit caught in the middle of that. 

And they have reacted, understandably, again, I think in two ways. 

By reducing the degree of cooperation, one, with respect to voluntary production of data rather than compelled production of 

data, and then, also at the margins in resisting certain compulsions. 

I want to be clear this is not in any way some kind of wholesale 

civil disobedience and it is again perfectly understandable given 

their fiduciary duties. Even if, in any given instance, one might 

argue that it either does not go far enough or goes too far. Given 

that problem and the nature of the problem, I think there has been 

consensus third that some kind of international solution is in order 

to address it. You have heard today about the MLAT process, and 

one of the solutions that has been discussed is some kind of fairly 

drastic increase in the resources available for processing MLATs. 

If the current time to process is 10 months and the equation scales 

linearly and I am not sure it does—if you wanted to reduce the 

time down to 1 day, you would be scaling up by a factor of 300. 

Again, I am not sure, it scales in a linear fashion. There are some 

structural limits in MLAT. 

And the other means of addressing the problem we have talked 

about today involve direct access by foreign governments. In some 
81 

carefully delineated class or sub-class of cases, I understand the executive branch is currently working with the U.K. on a bilateral 

agreement. Perhaps it would be limited to non-U.S. persons located 

abroad by analogy to the FISA Amendments Act. Perhaps to certain kinds of crimes; perhaps to certain kinds of directives on certain predicate showings made by certain officials in the U.K. You 

can imagine lots of limits here. And then, of course, Congress will 

need to evaluate whether those limits are appropriate and only 

then make the necessary amendments to the Stored Communications Act to allow that agreement to be effectuated. 

So, there is definitely a profound role for Congress in this area 

regardless of these executive agreement. Finally, I want to mention, but I do not know as we can discuss fully in this setting, a 

couple of foreign intelligence surveillance concerns that I outlined 

in my testimony. I urge you to have a conversation with the executive branch about the two gaps in FISA that I have set forth. I 

would love to be wrong about those, but I think it is something 

that is worth your exploring in an appropriate setting with the executive branch. Thank you very much. 

[The prepared statement of Mr. Kris follows:] 
82 
83 
84 

Mr. GOODLATTE. Thank you, Mr. Kris. Ms. Daskal, welcome. 

TESTIMONY OF MS. JENNIFER DASKAL, ASSISTANT PROFESSOR, AMERICAN UNIVERSITY WASHINGTON COLLEGE OF 

LAW 

Ms. DASKAL. Thank you, Mr. Chairman, Mr. Ranking Member, 

and Members of the Committee. Thank you for inviting me here 

today. I want to spend my time talking about three things. The 

problem, why Congress is needed, and specifically, what Congress 

should do. So, as has already been discussed pretty extensively, the 

Stored Communications Act operates as a blocking statute. It prohibits U.S. space providers from disclosing certain data, including 

emails to anyone other than the U.S. Government pursuant to a 

warrant. 

Now, let us consider U.S. investigation of a London murder. 

Imagine that the U.K. officials seek the emails of the alleged perpetrator to help establish motive. If the alleged perpetrator uses a 

U.K.-based provider, the officials could likely get access to the date 

within days, if not sooner. If instead, the data is held by an American-based provider, the Brits will be told that they need to go 

through the mutual legal assistance process and initiate a diplomatic request. This is, as we have already heard, a notoriously inefficient process taking an average of 10 months, and foreign governments are frustrated, understandably, by the state of affairs, 

and they are responding in a number of concerning ways, including 

the mandating of data localization which undercuts the growth potential of the internet, increases the cost to American businesses 

and facilitates domestic surveillance; unilateral assertions of extra 

territorial jurisdiction which put American companies in the crosshairs of two competing legal obligations with a foreign government 

demanding the compulsion of data and U.S. law prohibiting it; and 

the use of malware and other less accountable forms of accessing 

the sort after data, which undercut the privacy and security of all. 

Now, in response to this, as we have heard, the U.S. and U.K. 

have been negotiating an agreement that would allow the Brits, in 

certain circumstances, to make direct requests to U.S. companies 

for stored communications. Such an agreement is needed. If done 

right, it is an important step forward, which then brings me to my 

second point, the need for Congress. As we have already heard, 

none of this can be implemented without congressional authorization. 

So, what should Congress do? Congress should amend the Stored 

Communications Act. It should authorize the executive to enter 

into bilateral and multilateral agreements that would allow, in 

specified cases, foreign governments to directly request stored content from U.S. providers. In doing so, Congress should also set the 

key parameters of such agreements, ensuring, among other things, 

that the partner country meets basic human rights standards; that 

the particular requests satisfy a baseline set of procedural requirements; and, that the system is subject to meaningful transparency 

and accountability mechanisms. These parameters are essential 

and they are justified for at least two reasons. 

First, even as I think as envisioned by these agreements, the target of the request is a foreign national, it is likely, in fact, almost 
85 

certain that at some point, some time, such requests will lead to 

the incidental collection of U.S. citizen data. And second, whereas, 

the United States is often in the position of exhorting other countries to improve their human rights standards and protect free expression, this is one of those rare opportunities to couple such exhortations with a carrot, that of expedited access to U.S. data. And 

in so doing, help set the system of a global system of cross border 

access to data. 

Now, in making these recommendations for Congress to engage, 

I am not alone. For the past 6 months, I have been working with 

a cross-section of civil liberties groups, companies and academics 

all focused on the need to reform the system governing law enforcement access to data across borders. My recommendations draw 

heavily on the conversations with this group. Although, I speak 

solely in my personal capacity and not on behalf of anybody else. 

To sum up, the system for responding to law enforcement requests for data is broken. The time to fix it is now. Congress has 

an opportunity, and in my view, a responsibility to help build a 

system for the future. One that simultaneously safeguards privacy, 

protects American businesses and promotes the growth of an open 

and secure internet. Thanks. 

[The prepared statement of Ms. Daskal follows:] 
86 
87 
88 
89 
90 
91 
92 
93 
94 
95 
96 

Mr. GOODLATTE. Thank you very much, Ms. Daskal. We will now 

begin a round of questioning and I will recognize myself. Mr. 

Smith, let me follow-up on what Ms. Daskal just said, because that 

seems to get right to the crux of what has held up here in this 

process. So Microsoft supports international agreements that will 

address and overcome conflicts of law, but these agreements are 

likely going to allow foreign countries to acquire data held by U.S. 

companies on a standard less than probable cause. Do you support 

this, and if so, why? 

Mr. SMITH. Well, first of all, I would like to agree with the testimony that you just heard. I think we do need legislation. We do 

need international agreements, but I also believe that any international agreements that are negotiated should absolutely ensure 

that the rights of Americans are protected by U.S. law and the 

Constitution, including the probable cause requirement. 

Mr. GOODLATTE. How does allowing foreign countries to obtain 

data from U.S. companies on a less than probable cause standard 

square with the call for a uniform probable cause standard for requests by the U.S. Government? 

Mr. SMITH. Well, if the question is to me, I think the answer is 

two-fold. First, there will be benefit over time if the world can 

move toward a more uniform standard. But I think between now 

and then, the most important thing is that people have the protection of their own rights by their own law. I think that is fundamentally what most people in most countries want, and I think that is 

what Americans want for their own rights as well. 

Mr. GOODLATTE. Ms. Daskal, do you want to respond to that? 

Ms. DASKAL. I fully agree. 

Mr. GOODLATTE. Okay, well, so I am not quite sure I understand. 

If they are protected under their own laws, but their own laws do 

not have the same high standard of protection, and they are coming to the U.S., how are we going to have the carrot that you just 

referred to in your testimony to incentivize countries to provide 

greater protections? 

Ms. DASKAL. Sure, so that the suggestion that I was making is 

that when Congress authorizes these agreements, that it specify 

certain requirements that the country must meet, both at the country level and at making specific requests for that—— 

Mr. GOODLATTE. Would those be the standards contained in U.S. 

law? 

Ms. DASKAL. So, my suggestion would be for Congress to write 

in the amendment to the Stored Communications Act an exception 

to the blocking provision that basically says, ‘‘The executive has 

permission to enter into bilateral and multilateral agreements with 

foreign countries when the following conditions are met.’’ And some 

of those conditions should specify minimal standards that the requests have to meet. 

Mr. GOODLATTE. But not necessarily U.S. standards? 

Ms. DASKAL. Not necessarily U.S. standards—— 

Mr. GOODLATTE. Okay, I got it. All right, good. Then you are in 

agreement. Should a bilateral agreement—I will direct this back to 

you, Mr. Smith—should a bilateral agreement, such as the one 

under consideration with the U.K. also ameliorate any conflicts of 

law with regards to U.S. requests for data held by U.S. companies 
97 

*Note: The witness amends her response as follows: 

So, I absolutely think that a warrant requirement for content is necessary and is an 

important privacy protection when the United States is accessing data, but that is not 

the issue here. 

in that country? Would this not resolve the issue currently being 

litigated in the Second Circuit? 

Mr. SMITH. It would resolve the issue that is being litigated in 

the Second Circuit if the bilateral agreement were between the 

United States and Ireland. And I think what your question points 

to in part, is that if a model that works can be created between 

two countries, then there is an opportunity to replicate it elsewhere, but it will need to be replicated. 

Mr. GOODLATTE. And do you see any conflict between your position as it relates to foreign government access to data stored in the 

U.S., and your position as it relates to U.S. Government access to 

data stored abroad? 

Mr. SMITH. I believe that if you put an international agreement 

in place, that resolves any potential conflict. It creates the means 

by which two governments together, and respect the rule of law. 

Mr. GOODLATTE. Well, I get that, but it seems to me that if we 

agree to their standard, they agree to our standard, you still have 

two different standards that are in place. 

Mr. SMITH. But I think it really speaks to an important point. 

I think the American people want to have their rights protected by 

U.S. law. I was in London last week. I think the British people 

want to have their rights protected by British law. We need governments that have—I will just say a like-minded approach. It does 

not mean that they have to agree on every particularity though. 

Mr. GOODLATTE. Ms. Daskal, the rules established under ECPA 

govern what a U.S. provider can and cannot do with both communications content and non-content records. The result is that the 

ECPA procedures, including the warrant requirement apply to any 

customer of a U.S. provider regardless of that customer’s nationality or location and regardless of where the data is stored. Why 

is this insufficient to protect the privacy interests of all U.S. provider customers including foreign customers? 

Ms. DASKAL. So, I absolutely think that the answer to the question of the warrant’s requirement for content is necessary and it is 

an important privacy protection for when the United States is accessing data, but that is not really the issue here.* The concern is 

not about insufficient privacy protections; the real concern is about 

this really significant conflict of laws which over time is going to 

lead to an increasing number of things, like increased data localization, increased unilateral assertions of extraterritorial jurisdiction, 

other means of getting around these restrictions. And so that is 

where the privacy concerns come in, not because of the warrant requirement, which is a great requirement, but about what other 

countries are doing in response and what happens as a result of 

these conflicting obligations. 

Mr. GOODLATTE. Thank you. The Chair recognizes the gentleman 

from Michigan, Mr. Conyers, for his questions. 

Mr. CONYERS. Thank you, Chairman. Mr. Smith, it is important 

for technology to protect both privacy and security. Can policy pro-
98 

posals being considered today do both, or do they pit one against 

the other? 

Mr. SMITH. I think there are times when these two fundamental 

values, privacy and security, might be intentioned, but I think 

there are many times when creative and new laws that are designed for 21st century technology can move privacy and security 

forward together, and that is what we need to strive to do. 

Mr. CONYERS. Secretary Chertoff, do you have any additional 

comments on that same question? 

Mr. CHERTOFF. No, I agree. I think that actually, although occasionally, there is tension between the two, in many instances, you 

cannot really have privacy without security, and the value of security without privacy is much diminished. 

Mr. CONYERS. Thank you. One last comment from Mr. Smith 

from me—with respect to the Microsoft case pending in the Second 

Circuit, why has there been challenged the government’s demand 

for data stored in Ireland? What is your goal, or what is the corporation’s point in that case? 

Mr. SMITH. I think fundamentally, we believe that people need 

to be able to trust the technology they use. And part of their ability 

to trust the technology they use turns on confidence that their 

rights, people’s rights are going to be protected by their law. We 

store emails in data centers that are close to our customers. So, for 

example, when we have customers in the European Union, we store 

their data, their emails in our data center in Dublin or in Amsterdam. Our concern is that the U.S. Government first is using power 

that Congress never gave it. Namely, the power to go around the 

world to vacuum up emails pursuant to a U.S. search warrant. 

And second, our concern is because the U.S. is exercising this 

type of extraterritorial power on a unilateral basis, it is in effect 

saying, in this case, to the people of Ireland that their law does not 

matter; the DOJ does not even need to read it; it does not need to 

consult with the Irish Government; it does not need to pay any attention to the mutual legal assistance treaty in place between the 

U.S. and Ireland. All it has to do is turn to an American technology 

company and apply a power under U.S. law. That is not a recipe 

for the success of the U.S. technology sector, and it is not a recipe 

for ensuring people have trust in technology. 

Mr. CONYERS. Thank you. For Mr. David Kris—and I might ask 

Ms. Daskal to both consider this: I think a bilateral agreement 

framework could be a useful tool in resolving some of the conflict 

of laws issues that have been discussed here today. But there remain concerns, for example, about how we will reconcile British 

law with our own legal customs. How will we make sure that privacy, due process and human rights are respected by our partners 

in these agreements? 

Mr. KRIS. That is an excellent question and issue to raise. I am 

confident that Congress will have a role because even if the United 

States and Ireland or any other country reach an executive level 

agreement, for that agreement really to take effect, Congress will 

need to amend the blocking provisions, as Professor Daskal has referred to them, in the Stored Communications Act. 

And it will be, I think, up to you and incumbent on you as a Congress to decide which categories of cases involving what kind of, 
99 

**Note: The witness amends her response as follows: 

So, yes, I agree with all that and I would just—I think it is worth emphasizing that 

the agreement, as it was explained to us this morning, and I think as Congress should 

require as part of the adopted parameters, would solely permit a foreign government 

to get access to non-U.S. person data and data of people who are not in the United 

States. So, we are talking about the Brits being able to get data on their own citizens 

in connection with the investigation of a local crime. 

say, defendant, non-U.S. persons located abroad have been discussed, such that U.S. persons, or persons in the United States 

would not be subject to the exemption. Different kinds of crimes exempting political crimes from this provision, for example, various 

other limits are all possible. And Congress will have an opportunity 

to consider those, if and when it decides to amend the Stored Communications Act to permit this kind of direct access by way of executive agreement in some specified subset of cases that meet with 

your policy approval. 

Mr. CONYERS. Ms. Daskal, would you add anything? 

Mr. ISSA [PRESIDING]. Go ahead, Mr. Ranking Member. 

Mr. CONYERS. Thank you. 

Ms. DASKAL. So, yes, I agree with all that and I would just—I 

think it is worth emphasizing that the agreement, as it was explained to us this morning, and I think as Congress should sort of 

adopt as parameters as well, would solely permit a foreign government to get access to non-U.S. person data and data of people who 

are not in the United States.** So, we are talking about the Brits 

being able to get data on their own citizens in connection with the 

investigation of a local crime. 

And Congress, I think, because we are talking about U.S. providers, has a role to play in setting some minimal standards, some 

minimal important procedural and substantive standards as to 

what the Brits must do in order to get access to that data from 

U.S.-based providers. But we are not talking about the British requesting data about American citizens, American permanent residents, or Americans in the United States. 

Mr. CONYERS. Thank you all for your responses, and I thank you, 

Mr. Chairman. 

Mr. ISSA. Well, thank you, Mr. Conyers. We now go to the distinguished gentleman from Texas, Mr. Poe. 

Mr. POE. I want to thank the Chairman. Thank you all for being 

here. I, being a lawyer, I did not go to Harvard, but I went to the 

University of Houston, which we call Harvard on the bayou fondly 

in Texas. But, Mr. Chertoff, it is great to see you again. Thanks 

for your service to the country that you have done in the past. 

Mr. Smith, I am impressed by your statement. Passionate and 

you did not read it, so it is obvious that this is important to you. 

It is important to the country. This, by way of kind of review, 

ECPA, 30 years old. It would seem to me that we have known for 

a long time that ECPA law needed to be reformed. And 30 years 

is long enough for Congress to finally pick a horse and ride it and 

make some choices and changes in the law to solve the problems 

that all of you have discussed; whether it is nationally; whether it 

deals with business; whether it deals with foreign countries; the information; do you think it is about time that we make a decision 

on reforming ECPA? 
100 

Mr. SMITH. I think that the time has come and it is perhaps even 

overdue. I think what you are really hearing from all of us today 

and you hear it from the tech sector every day, is that we really 

do need a new law, and we need Congress to write it. 

Mr. POE. And it should be Congress’ responsibility to set the 

standard of law rather than letting the courts make the determination as to what the expectation of privacy is for citizens, or corporations, or letting the Justice Department take the law as they see 

it and interpret it the way they see it. Congress needs to weigh in 

and make these decisions and make it the law of the land. I mean, 

that is our responsibility. 

Mr. SMITH. Absolutely, and I think, frankly, one of the points 

that we have heard this morning that should give all of us the 

most concern is the acknowledge by the Justice Department that 

the Stored Communications Act passed in 1986 is silent on whether 

the DOJ has the authority to apply these search warrants worldwide. And the DOJ says, that because Congress was silent, the executive branch has power. Well, that basically amounts to an argument that Congress needs to write really long laws, because every 

time Congress neglects to address something, it is giving Congress—it is giving the executive branch some power. That is not 

the way the Constitution was written. That is not the way common 

sense works. 

Mr. POE. There you go. I agree with that. And the Justice Department, they are doing what they think they can do under the 

law, and I think they are wrong, but ECPA was written to protect 

privacy of individuals. That is the purpose of the law, why it was 

written. So, Congress needs to weigh in on it, pass legislation that 

has been pending for a long time. I think we set the standard for 

the expectation of privacy. It should be up to us, not some judge 

or group of judges, and we need to move on with that. Set aside 

those comments, and tell me the economic impact of not making a 

decision, and how that is affecting industry. 

Mr. SMITH. I think there are two ways to think about this. One 

is narrow, one is broad. They are both important. First, because we 

are seeing this emerging conflict of laws, we are seeing the risk of 

increasing fines on U.S. companies when we get into these conflicts. Already to date, Microsoft has been fined $28 million by the 

Brazilian authorities because of this—— 

Mr. POE. And that is a criminal fine. That is not a civil fine. That 

is a criminal crime. 

Mr. SMITH. Right, yes. This is all connected to a criminal proceeding, and we are being fined simply for obeying U.S. law, and 

think about a start-up and what $28 million means. But the implications are really broader because I find, in countries like Germany 

and the United Kingdom, where I was last week, I increasingly 

meet people in government and elsewhere who say that unless this 

issue is resolved—they basically say, ‘‘Unless you win your case in 

New York, we are not going to be able to trust American technology and we are not going to be able to move our content to the 

cloud when the cloud is operated by a U.S. company with a data 

center.’’ So, a lot is at stake for the American economy and American jobs. 
101 

Mr. POE. Well, I appreciate all of you being here. I do not have 

time to ask the rest of you questions. But I think you are exactly 

correct. For the problems that you have all mentioned, it is time 

for Congress, like I said, to pick a horse and ride it and let us pass 

some legislation to fix this problem. And I yield back. 

Mr. ISSA. I thank the gentleman. We now go to the gentlelady 

from San Jose, Ms. Lofgren. 

Ms. LOFGREN. Thank you. Before my questions, I would ask 

unanimous consent that we put into the record the Yale Law Journal article by our witness, Ms. Daskal. 

Mr. ISSA. Without objection, the document will be placed in the 

record. 

Ms. LOFGREN. Thank you. This has been a very interesting hearing and, comes at interesting time for our country, because the 

issues we face are of law, but also of technology. And I do not think 

we can talk about the legal issues without getting into the technology issues. And I was looking at the Trans-Pacific Partnership 

Agreement. Now, some of us have issues about human rights in 

Vietnam, you know, health issues and the like, but in terms of 

encryption, it is pretty clear. 

It basically says that you cannot require a backdoor, an 

encryption, if you are a party to this agreement. It prohibits governments from requiring companies to either disclose their keys or 

to use specific cryptographic algorithms. And the Department of 

Justice’s application and courts’ subsequent decision to compel 

Apple to provide special software circumventing security protections would actually violate this international norm, that is specified in the TPP, against government mandates for backdoors. But 

also, we had several votes here in the House of Representatives 

where we had over two-thirds of the House vote in opposition to 

backdoors. 

So, I am wondering, Mr. Smith, if I could ask you, what is 

Microsoft’s view of this? Do you support the position that Apple has 

taken, that the court is setting a dangerous precedent by forcing 

Apple to break its own security protections? Does Microsoft plan to 

be involved in the litigation that apparently is going to go on for 

a while? I know Mr. Gates said something, but he has been gone 

from the company since—for a long time. I am just wondering what 

the—Microsoft’s position is, if that is fair to ask? 

Mr. SMITH. Yeah, we at Microsoft support Apple, and we will be 

filing an amicus brief to support Apple’s position in the court case 

next week. And I believe that Apple is making an important point 

that, in fact, connects directly with the kinds of issues that are 

being considered by this hearing today. 

In the Apple case, the Justice Department has asked the magistrate to apply language in the All Writs Act that was passed by 

Congress, and written in 1911. The leading computing device of 

that era is right here in front of me. It is an adding machine that 

went on sale in 1912. Quite simply, we do not believe that courts 

should seek to resolve issues of 21st century technology with law 

that was written in the era of the adding machine. We need 21st 

century laws that address 21st century technology issues, and we 

need these laws to be written by Congress. We, therefore, agree 

wholeheartedly with Apple that the right place to bring this discus-
102 

sion is here, to the House of Representatives and the Senate, so the 

people who are elected by the people can make these decisions. 

Ms. LOFGREN. Well, thank you very much, and do you have any 

other props? 

Mr. SMITH. No, not props. 

Ms. LOFGREN. I was surprised to see that, but—— 

Mr. SMITH. But believe me, it is amazing what you can buy on 

the internet. 

Ms. LOFGREN. Well, I have heard that—— 

Mr. ISSA. Would the gentlelady yield? 

Ms. LOFGREN. If I can get—— 

Mr. ISSA. What is the operating system on that? 

Ms. LOFGREN. What is the operating system? 

Mr. POE. It is called a hand crank. 

Ms. LOFGREN. I would like to follow up because I actually very 

much believe that the encryption issue should be before Congress. 

The Judiciary Committee has started that process, but the Justice 

Department alleges that this is just one phone, and I was surprised 

to hear that when we heard the district attorney in New York saying he had 175 phones and then we found out there were a number 

of others where we are seeking to utilize the new operating system 

that the court has ordered Apple to devise. Do you think that this 

issue goes beyond that one phone? 

Mr. SMITH. Well, every case is obviously about one case, but 

every case obviously has implications for lots of other cases. The 

real concern here is actually the law and the implications for the 

future. And the only way to get the law right for the future is for 

Congress to act. 

Ms. LOFGREN. If I can just close, Mr. Chairman, I started with 

the TPP, the international standard, and that is important because 

encryption keeps us safe. It keeps people from breaking into our 

data systems and causing problems for us. The either hackers or 

terrorists or enemies of our country and I—the idea that my data 

would have to be opened to hackers in China because of specific 

cases is really what I think this is about, and I thank you very 

much, Mr. Smith, for answering. 

Mr. ISSA. I thank the gentlelady. We now go to the gentleman 

from Pennsylvania, Mr. Marino. 

Mr. MARINO. Thank you, Chairman. Secretary Chertoff, you mentioned a term, legal regime, in your opening. Would you expand on 

that? And do you mean legal regime, meaning legislation, or an expansion of MLAT, or something else, or a combination? 

Mr. CHERTOFF. I really principally meant legislation, because as 

I think we also started a discussion about encryption, in order to 

make decisions about how to structure a legal architecture, when 

you are dealing with global data, different forms of citizenship and 

evolving technology, I can tell you having been a judge, the courts 

are not equipped to weigh all of those things, and the unintended 

consequences of a decision are often not clear in an individual case. 

So, to me, this cries out—I know Chairman McCaul suggested a 

commission to look at the issue of encryption, but to me, this cries 

out for taking a comprehensive look at the way the technology actually exists in the real world, and how one can then reconcile the 
103 

need to preserve privacy and the need to promote security with 

that technological background. 

To give you one example, you know, 100 years ago, when they 

first invented telephones and photography, initially the courts tried 

to deal with the issue of the Fourth Amendment by forcing the 

facts into those old rules about not searching someone’s houses. So, 

we had the trespass cases. And finally, in some of the more recent 

cases, the court said, ‘‘Wait a second. This is about expectation of 

privacy.’’ It is not just about whether I physically invaded a room 

or wire. And I think we need to have that kind of technologicallyinformed discussion now. 

Mr. MARINO. Thank you. Mr. Smith, what do you do in a situation when you have conflicts like you have explained, as far as advising your employees on how to approach these matters? 

Mr. SMITH. Well, it is really a terrible situation that we are being 

put into. I thought Chairman Goodlatte put it well at the outset 

when he referred to it as a Hobbesian choice. Imagine the kind of 

meeting that I have had to have with a Brazilian employee who is 

being prosecuted. And imagine trying to talk about the fact that we 

cannot, in fact, take the steps that would bring the prosecution to 

an end in Brazil, because it would require that we commit a felony 

in the United States. This is a classic example, I think, of the fact 

that we need governments to act, and we need our own government 

and we need this Congress to act, perhaps most of all. 

Mr. MARINO. Thank you. Ms. Daskal, referring back to the secretary’s atement on legislation, do you agree with that, or do you 

see a combination of varieties of treaties and legislation, or just the 

legislation? 

Ms. DASKAL. So, again, it depends on the specific issue, but with 

respect to the problem of conflicting laws, there absolutely needs to 

be legislation. 

Mr. MARINO. Good. 

Ms. DASKAL. Because the executive does not have the authority 

to enter into the kinds of agreements that are needed without Congress authorizing it and ideally setting parameters as what those 

agreements look like. 

Mr. MARINO. Thank you, and Mr. Kris, would you expand a little 

bit on the two points you raised in the FISA gap? 

Mr. KRIS. Sure. Again, I would love to be wrong on this. I mean, 

I do think you should have a conversation with the executive 

branch, but the jurisdiction and the reach of the FISA statute depend fundamentally on the definitions of electronic surveillance 

and physical search in the statute itself, and those are very, very 

complex. But I am concerned that given the way those definitions 

are written, the statute cannot currently be used to compel the production of data stored abroad; for example, the kind of situation we 

have in the Second Circuit case involving Microsoft. 

If the target of the surveillance is either a U.S. person located 

anywhere, or a person of any nationality located here, in either of 

those situations, I am concerned that the statute cannot be used 

to issue a compulsion order to a provider to turn over the data, and 

the government has to rely on a voluntary repatriation of the data 

back into this country to bring it within the jurisdiction of the statute. 
104 

Mr. MARION. Thank you. I yield back. 

Mr. ISSA. Gentleman yields back. With that, we go to the 

gentlelady from Texas, Ms. Sheila Jackson Lee. 

Ms. JACKSON LEE. Thank you very much. I noticed in the course 

of materials that I have here that—oh, first of all, let me thank all 

the witnesses for their testimony. And I take note of the fact—and 

I want to ask Mr. Smith and Mr. Chertoff on this; that the issue 

at the European Union had been an outstanding issue for a period 

of time in terms of data and data protection, privacy. And just recently the U.S. data transfer pack was agreed to. 

Can both of you comment on what impact as we are discussing 

legislation, the LEAD Act, and where are in the having not acted, 

what that agreement does for you, even if it is sort of around the 

ring of what we are discussing? Mr. Smith first. 

Mr. SMITH. Yeah, well thank you for asking that question, congresswoman, because it actually raises a very important point that 

we have not talked about yet today. You know, the recent Safe 

Harbor negotiation I think, you know, put a Band-Aid on a legal 

system that has been in existence since the year 2000 and, therefore, it appears the data will continue to be able to move across the 

Atlantic. But time and time again, to this morning you heard Mr. 

Bitkower talk about whether there is or is not a conflict of laws 

across the Atlantic. The key thing we need to think about here is 

that the new European Union General Data Protection Regulation 

will take effect in 2 years. And that regulation has an article, Article 43A, that will make it unlawful for a company to move data out 

of Europe to comply with a search warrant unless it is done pursuant to an international legal agreement or process. 

So in 2 years, a legal curtain is going to descend across the Atlantic. There is going to be a conflict in every one of these cases 

the Justice Department wants to pursue on a continent that has 

508 million people living on it, unless action is taken to put new 

international agreements in place. 

Ms. JACKSON LEE. And so that would be aside from a statute 

here in the United States. It would be additional international 

agreements. 

Mr. SMITH. Basically what it means, I believe, is that we have 

2 years to try to figure out how to craft an agreement, as we are 

trying to do with the United Kingdom, get legislation in Congress, 

and then determine how and whether to replicate that with the 

other countries in the European Union; so we do not have a day 

to waste. 

Ms. JACKSON LEE. Sense of urgency; Mr. Chertoff, thank you for 

your service as Homeland Security secretary. So, I am going to add 

a subset to the question is to reflect on the international agreements, but also reflect upon the crucial question of privacy and security in the backdrop of what we are facing now. And Microsoft 

case represents—even the case was a criminal case we have, as an 

ongoing looming issue, is at least a dialogue or the issue of Apple. 

But can you, from your perspective, speak to how we have a number of factors that are impacting on our decision for the legislation 

and our exchange on data? 

Mr. CHERTOFF. Yeah, well thank you. And again, it is a pleasure 

to appear before you again. I agree with what Mr. Smith said about 
105 

the need to particularly work out an agreement with the Europeans, because they have typically been, at least some of the countries there, the most reluctant to cooperate in these areas. And yet 

the urgency of doing that cooperation now is more evident than 

ever when you look at what happened in Paris. 

So we ought to move forward with that. I think in general also, 

though, there are a series of issues which require us to think in 

a little bit more of a technologically savvy way about how we deal 

with data. And to go back to Congresswoman Lofgren’s point on 

encryption—I am a real believer that it would be a mistake to legislate a requirement to create backdoors or duplicate keys or other 

limitations on the ability to have ubiquitous encryption. Because I 

know that encryption is one of the key tools that we use to protect 

innocent people against criminals or, for example, the North Koreans getting into your data. And to sacrifice the security of the 

many in this instance seems to me to be not worth it, particularly 

because I am quite confident that the bad guys can find tools overseas that are going to wind up allowing them to encrypt anyway. 

But, again, this is an area where I think—I know there is a litigation going on now. For a court to be asked to make or resolve 

this decision strikes me as the wrong way to go about it. This is 

something that requires looking end to end at what the problem is 

in trying to reconcile what—I do not think they are inevitably contradictory impulses. But what I think are impulses that need to be 

coordinated and synchronized so we do not go too far in the direction of handicapping security, and too far in the direction of handicapping privacy. 

Ms. JACKSON LEE. Mr. Chairman, thank you very much. Mr. 

Chairman, can I sneak in one question for Mr.—— 

Mr. GOODLATTE. Quickly, because we have just enough time for 

each Member to have 5 minutes before our hard stop at 1:30. 

Ms. JACKSON LEE. In answer to Mr. Chertoff, the LEADS legislation does lay out a process. What is your comment on the statutory 

fix for this issue? Did you hear me? 

Ms. DASKAL. Yeah, yes. 

Ms. JACKSON LEE. Yeah, thank you. 

Ms. DASKAL. So I think the fact that the Congress is engaging 

with LEADS is a terrific step forward. I do have some concerns 

about LEADS as currently written in the way that it makes jurisdiction turn on the location of data, which I think has all kinds of 

practical and normative problems, because of the way data moves 

around so quickly, because of its divisibility, because of the fact 

that oftentimes when we store things in the cloud we do not even 

know where it is located at any given time. So making jurisdiction 

turn over where our data is does not seem to make a lot sense. 

That said—— 

Mr. ISSA. Thank you. I am afraid we are going to have to cut you 

off but—— 

Ms. JACKSON LEE. I think you and I thank the Chairman. 

Mr. ISSA. Thank you. 

Ms. JACKSON LEE. I thank the witnesses. 

Mr. ISSA. Young lady from California, Ms. Walters. 

Ms. WALTERS. Thank you, Mr. Chairman. Mr. Smith, your testimony describes Microsoft’s dilemma with the Brazilian Govern-
106 

***Note: The witness amends her response as follows: 

And so that is why this opportunity to enter into agreements and to set at least some 

parameters is a really important opportunity for the United States to engage, to set the 

ment seeking disclosures that would blatantly violate U.S. law. 

And I am sure that legal predicaments like this will only increase 

as governments enact laws that create additional conflicts. These 

legal quandaries undoubtedly have negative impact on Microsoft as 

well as other tech companies, and ultimately impair a vital sector 

of the American economy. And I know Mr. Poe had asked this 

question, and you had discussed the fines levied against Microsoft. 

But I wanted to give you additional time to discuss how this situation has impacted your global customer’s willingness to trust 

Microsoft products, and what it has done to your business. 

Mr. SMITH. Well I think more than anything else, congresswoman, your question, which is very important, just underscores, 

first of all, the importance that people would be able to trust technology. We are all putting so much of our most sensitive information on devices and in the cloud that people, by definition, only 

want to use technology they can trust. 

So the fundamental question that people around the world are 

asking is whether they can trust American technology. You know, 

we face this as one American company but I think this is a question that every American company is having to face. And there are 

a variety of steps we are trying to take to address it, we are being 

more transparent ourselves; I think that is a good thing. We are 

taking steps to advance privacy, to address and advance 

encryption; I think that is a good thing. But at the end of the day, 

the concern that I hear around the world is that regardless of what 

we do, the U.S. Government may use its long arm to reach unilaterally across borders and without regard for other countries’ laws. 

So we need to fix that part as well. We obviously need to do it 

in a way that ensures that law enforcement can do its job; that is 

why these kinds of new agreements are needed. 

Ms. WALTERS. Yeah, thank you. And then I have a question for 

the entire panel. What does the internet look like if we do not act 

and data localization becomes the norm? 

Mr. CHERTOFF. I do not want to be overdramatic but you do not 

have an internet. You have a series of internets or intranets in individual countries. And so much of the value of the internet, which 

is the ability to operate on a global basis, is hampered. It also 

means that from an engineering standpoint some of the considerations that you have when you put a server in a particular place 

gets subordinated to issues about how to manage the legality or 

kind of legal arbitrage from one jurisdiction to another. 

Ms. DASKAL. I would just add as well I completely agree. But I 

think the other piece of this that is important is when that happens, the United States no longer has a role to say in terms of 

what protections do or do not apply when a country is getting access to data. And so that is why this opportunity to enter into 

agreements and to set at least some parameters is a really important opportunity for the United States to engage, to set the parameters, and to do so in a way where the world is still talking to each 

other.*** 
107 

parameters, and do so in a way that protects our privacy, security, and economic interests. 

Mr. SMITH. And the last thing I would mention is the consequence of that kind of data localization trend and set of requirements is that computing gets more expensive, because it forces 

companies to build more data centers than, frankly, the world 

needs just so you can have a data center in every country. That 

costs money; that is going to lead to higher prices. 

Ms. WALTERS. Okay, thank you, I yield back. Do you have anything to add, Mr. Kris? No. I yield back, thank you. 

Mr. ISSA. I thank the gentlelady. We now go to the gentleman 

from Georgia, Mr. Johnson. 

Mr. JOHNSON. Thank you. Since we have veered down the road 

of encryption, and it being a fact that encryption keeps us safe 

from hackers and garden-variety criminals, we also have this issue 

of a ungoverned space that is created by encryption; a ungoverned 

space wherein terrorists can conspire with impunity. 

So, you know, on one hand, we have encryption that helps keep 

us safe from hackers, but then we also have encryption that helps 

keep terrorist conspirators safe from discovery. And then we have 

the issue of international competition companies, multi-national 

corporations, multi-national companies competing in an international market for customers with privacy, or encryption, being a 

selling point. And this is quite interesting. 

It can cause a lot of fear in the minds of people concerned about 

law enforcement, concerned about intelligence, international intelligence. And so we see where we have gotten to the point where 

technology has exceeded the capacity of law enforcement, both 

internationally and domestically, to be on top of the situation 

which leads us into an area of anarchy, lawlessness. Encryption, 

Mr. Chertoff—you have talked about the fact that it protects us 

from hackers. What is your view about terrorists who are able to 

conspire with impunity in that environment? 

Mr. CHERTOFF. Well, Congressman, this is a—look, this is a serious issue, and I take the concerns of the FBI and the law enforcement community very seriously; I understand why this worries 

them. I guess my response is this: First of all, I know that even 

if Congress says that companies or items—companies that manufacture items here have to create backdoors or duplicate keys, people who want to do bad things will find devices that do not have 

backdoors or duplicate keys. 

I point out to people that the so-called dark web, where a lot of 

criminal activity goes on undetected because it is all anonymized, 

is powered by the Onion Router Tor, which was actually funded by 

the United States Government as a way of providing anonymity for 

people who were dissidents. The second thing I would say is that 

it has always been the case, and I go back in my years of doing 

law enforcement, that bad people were able to communicate with 

each other without being detected. 

In the old days when we were doing mob cases, they would either 

turn the radio way up so the listening device could not record it, 

or they would take a walk around the block. And we nevertheless 

succeeded in putting a lot of those folks in jail. 
108 

And the third thing I would say is that actually, if you look at 

the technology that exists nowadays, and the amount of metadata 

that is generated that is not encrypted, I would venture to say that 

from the intelligence and law enforcement standpoint, the ability 

to detect terrorism now is fantastically better than it was even 15 

years ago when, in the wake of 9/11, we were trying to hunt down 

terrorists in this country. 

So, as with all technologies, there are elements of it that are 

problematic for law enforcement, but there are elements that help 

law enforcement, and I still think the balance favors our security. 

Mr. JOHNSON. Thank you. I do not have anyone on the panel to 

ask if they would disagree with that, I assume. So with that I will 

yield back. 

Mr. ISSA. And with that I would recognize the gentlelady from 

Texas for unanimous consent. 

Ms. JACKSON LEE. Mr. Chairman, thank you and the Ranking 

Member. I would like to submit two articles into the record, ‘‘New 

European U.S. Data Transfer Pack Agreed,’’ dated February 2, 

2016. 

Mr. ISSA. Without objection so ordered. 

Ms. JACKSON LEE. Reuters, and Washington Post, ‘‘The British 

want to come to America with Wiretap Orders and Search Warrants,’’ dated February 4th. 

Mr. ISSA. Without objection so ordered. 

[The information referred to follows:] 
109 
110 
111 
112 
113 
114 
115 

Ms. JACKSON LEE. Thank you. 

Mr. ISSA. We now go to Mr. Ratcliffe. 

Mr. RATCLIFFE. Thank you, Mr. Chairman. Mr. Chertoff, or Secretary Chertoff, I thank you as well for your service while you were 

over at the Department of Homeland Security, I was a U.S. attorney and a former terrorism prosecutor. So I wanted to ask you 

about your testimony; you seem to suggest that we revert to a global standard of data control based on where the target of the investigation is a resident, is that right? 

Mr. CHERTOFF. Actually, I would be probably inclined to say it 

should be based on where the citizenship of the accountholder as 

opposed to the target. But I could see an argument that might look 

at the target as well. But I think probably the accountholder makes 

the most sense. 

Mr. RATCLIFFE. Okay, well let’s walk through a scenario that we 

have probably both been through before. What if the information 

on say a suspected terrorist is located, and to use an example others have used here, is actually stored in Ireland but we know—let’s 

say we know that that individual is a Saudi national. How would 

you reconcile that? 

Mr. CHERTOFF. Well, so first of all, I mean I think the default 

position would be to go based on a treaty request, like an MLAT, 

but hopefully in a world in which these requests are not 10 

months, but are more like 10 hours. And we have seen from what 

Mr. Smith said that it is possible, in fact, to do that. 

Mr. RATCLIFFE. Okay. So under the standard that you—tell me 

the impact that you would think that would have with respect to 

national security investigations generally. 

Mr. CHERTOFF. Well, and again, I am predicating this on a more 

efficient regime of answering these requests. But I think in many 

ways we have dealt with these cases in the past. I think that provided people put an adequate priority on this—and my experience 

is generally they do in a terrorism case—I think it would not impede investigations unduly, and I think what it would do is avoid 

the kind of conflict that actually winds up slowing up investigations, because that person who is holding the data, or the entity 

that is holding the data, is caught on maybe unnecessarily between 

two conflicting legal systems when an agreement to go by way of 

a treaty would eliminate that sense of conflict. 

Mr. RATCLIFFE. Do we get into a situation there where we would 

be increasing our reliance on intelligence authorities rather than 

law enforcement authorities? 

Mr. CHERTOFF. Well, I will acknowledge to you that when you 

are dealing with terrorism, particularly prevention, a lot of what 

we do is intelligence based. And that is a different set of issues 

than access by legal process. And so I am not suggesting we do not 

do that, but I am saying if we are using legal process, I think a 

system that eliminates conflict is something that both enables us 

to actually speed up cooperation, and avoids putting companies in 

a difficult position. 

Mr. RATCLIFFE. Okay. And speaking of processes, you mentioned 

before the MLAT process. And you may have already given your 

thoughts with respect to reforms, but that was something that I 

tried to utilize during my time at the Department of Justice and 
116 

admittedly not very effectively utilized it. And so I want to give you 

an opportunity to expound on the MLAT process and the best way 

to reform that from a congressional perspective. 

Mr. CHERTOFF. Well, your experience and mine are very similar. 

And I think there are two elements to this. One is I think the technology, at least when I was a prosecutor, you know, it was a paperbased system. And it tended to be, from a technological as well as, 

frankly, a priority standpoint, you know, pretty slow. I think we 

could build a technology platform that would make this much, 

much quicker. We see this in a lot of areas in the commercial domain. 

I think the second issue would be the policy standpoint. And 

there, I think, whether it is additional resources, or a decision at 

a high level of the law enforcement community to treat at least a 

certain category of these very high priority would be—enable us to 

move these more quickly. And I think, again, the lesson of what 

happened after the Paris attacks, where it took 45 minutes to respond to a request is illustrative. 

Mr. RATCLIFFE. Right. Well, out of respect for the other Members 

that have questions, I will yield back the balance of my time. I do 

want to thank everyone for being here. We all understand what an 

important issue we are discussing today. I yield back. 

Mr. ISSA. I thank the gentleman. We now go to the gentlelady 

from Washington, Ms. DelBene. 

Ms. DELBENE. Thank you, Mr. Chair. And thanks to all of you 

for being with us today. Mr. Smith, when ECPA was written many 

years ago, as you were highlighting, in 1986, it was also the very 

early days of email. When I first started working on email in 1989, 

even then it was still really only used in companies that had it for 

internal communications. And if you did get an email, folks always 

downloaded it from a server because capacity in servers was very 

low. And they would regularly delete those servers to have room 

for new information. 

So it seems clear that some of the fundamental technical assumptions that were made when ECPA was written have definitely 

changed vastly since then. And I wonder if you could comment on 

the mechanics of cloud computing today and what legal questions 

that creates, especially with respect to ECPA. And why cannot the 

courts just shoehorn kind of all of these—today’s legal issues and 

to, like, the international storage issue, into that old law. 

Mr. SMITH. Well I think your question raises an excellent point. 

A company like Microsoft built its first data center outside the 

United States only in 2010. So cloud computing and the explosion 

of cloud computing is really a phenomenon of this decade. That is 

what has created all of these issues that we are talking about 

today. And it has created the need at times for law enforcement, 

quite rightly, to want to get access to information, to content, to 

email in other countries. 

I think the fundamental question in a sense from a U.S. legal 

perspective is that when technology moves forward and the law 

needs to catch up, as it does here, what is the best way for that 

to happen? And we would say the best way is for the executive 

branch, if it wants new power, to come back to Congress and ask 

Congress to enact it. 
117 

Ms. DELBENE. And when you say when the law was written it 

was written actually with respect to the way technology was working then, as opposed to providing intent going forward. 

Mr. SMITH. Well absolutely, and the most interesting and telling 

aspect of ECPA in this regard is the fact that it applied a lower 

standard to protect email that was over 6 months old. And that 

was all based on some thinking in the 1980’s that, I think, barely 

anybody can remember, that most businesses moved their paper 

records offsite after 6 months. Maybe that was true. But who the 

heck has an email account that has only email that is less than 6 

months old? The answer is only email accounts that have been 

opened less than 6 months ago. All the rest of us have email that 

is older than that, and that just shows how much the world has 

changed. 

Ms. DELBENE. And with the shift to cloud computing now, more 

and more of that information is stored on servers. 

Mr. SMITH. Well, the amazing thing about the cloud, as you point 

out quite rightly, is now we are not only talking about email, we 

are talking about all the photographs of our lives. We are talking 

about all of the other digital records that we have. We are talking 

about the PDFs that—in our lives. It is everything that sort of documents what we do every day. 

Ms. DELBENE. And do you think that people should have a different expectation of how digital information is treated versus 

physical information? Is there a legal significance to the fact that 

you might information that is in digital form versus paper form? 

Mr. SMITH. I think that technology needs to advance, but certain 

timeless values need to endure. And among these timeless values 

are the rights to privacy. And every time the American public has 

been asked, they have said the same thing. They want the data 

they store in the cloud to get the same privacy protection as the 

information they store on paper. And I think that is exactly the 

right point of view. 

Ms. DELBENE. Does anyone else think there is a difference between digital or paper in terms of the legal significance and that 

differentiation? 

Mr. Chertoff. I agree with Mr. Smith. I think one of the challenges here, frankly, is people—sometimes because of the fact that 

the data moves electronically and seamlessly, conflate what is a 

business record and a provider with what is something that a provider holds as a custodian so to speak. And to use an example from 

the banking world, it is one thing to subpoena a bank for bank 

records which are the bank’s own documents or the bank’s own information. 

It is another thing if you want to get into a safety deposit box. 

The bank does not have a limitless right to enter the box and, 

therefore, you need a warrant for the box that is separate and distinct from a subpoena for the business records. And because electronic data does not neatly fall into that obvious category, categorization, there is a tendency to conflate the two. But I think as 

Brad says, that the principles ought to be the same. 

Ms. DELBENE. Mr. Kris? 

Mr. KRIS. I would just say the two factors that strike me as the 

most significant here are first, the incredible amount of digital data 
118 

that is now created and available. Digital dust or digital footprints 

of your daily life are everywhere created. And they are also, second 

point, stored with third parties in a way that they did not use to 

be. And so I find myself in strong agreement with Mr. Smith when 

he had his 1912 adding machine in front of him. 

It is, I think, important and appropriate for Congress to look at 

the All Writs Act again. I would go further, and suggest you also 

consider the technical assistance provisions in both the Wiretap Act 

and FISA to clarify exactly what kind of assistance is going to be 

required from third parties in making digital data in the clear 

available to the government. You know, at one extreme is legislation now pending in the U.K. which, if I read it correctly, would 

essentially allow them to compel providers to push down widgets, 

malware in bulk, across a network and all the users on that network. 

And at the other extreme would be, you know, essentially no 

compelled assistance. There is going to be a middle ground there, 

and I think Congress is the appropriate institution of our government to come to grips with that. 

Mr. ISSA. I thank the gentlelady. And with that we go to the gentleman—— 

Ms. DELBENE. Sorry, my time expired. 

Mr. ISSA. Yes, I am afraid so. And we now go to the gentleman 

from South Carolina, Mr. Gowdy. 

Mr. GOWDY. Thank you, Mr. Chairman. And I apologize for having to leave. I had a meeting on the Senate side. But I am happy 

to report that they are up at this early hour working on the Senate 

side. And I see that almost all the good lawyers have gone, so it 

is my turn. Mr. Smith, from a law enforcement perspective, you receive a warrant for information that you maintain in a foreign 

country. And I know some of this has already come up, but just 

humor me because I find this stuff interesting and I would rather 

you say it twice than not say it once. You get a search warrant for 

material that is in a foreign country from a U.S. law enforcement 

official, and it violates the law of that foreign country for you to 

access that information. How do you resolve that? 

Mr. SMITH. Well I think the real problem is we are just being put 

in an impossible position. You know, certainly what we have done 

to date is looked at U.S. law and if the information is in the United 

States and it would violate the Stored Communications Act for us 

to turn it over, we simply do not turn it over. That is why, as I 

was saying earlier, we have now been fined $28 million by the Brazilian Government, and we have an executive there who is being 

prosecuted. I think the big quandary we are all going to face in 2 

years is what happens once the new European Union regulation 

takes effect, and their blocking statute that would prohibit us from 

turning information over to the DOJ outside of an international 

agreement kicks in. I do not see how we can turn information over 

to the Justice Department if it is in Europe, and European law prohibits us from doing so, which is why I think the fundamental argument that the Justice Department, that it needs this, both has 

some merit but, ultimately, frankly, sort of misses the point. The 

day of unilateral search warrants is fast coming to an end; it needs 
119 

to be replaced by something new and something better and we had 

better act quickly. 

Mr. GOWDY. Are there any facts from the Brazilian fact pattern 

where you have an executive that is facing—did you say criminal 

prosecution? 

Mr. SMITH. Yes, criminal prosecution. 

Mr. GOWDY. For being out of compliance with a discovery order, 

or what is the procedure for where he finds himself, or herself? 

Mr. SMITH. You can think of it as akin to what in the United 

States would be a contempt order from a court. You know, a local 

court has issued a local order requiring us to turn over certain information but in this case the information is not in Brazil, it is in 

the United States, and U.S. law prohibits us from turning it over. 

As we talk about pressure for data localization, this is the ultimate 

pressure for data localization. Because obviously, what it is intended to do is encourage U.S. companies to build data centers in 

Brazil so we no longer have to follow U.S. law. 

So, again, the specter of concerns that people have in some ways 

are coming true before our very eyes if we cannot find a better way 

to solve them. 

Mr. GOWDY. For those of us in the past who have experienced the 

joy of facing potential contempt from a judge, what is your executive supposed to do? How is he or she supposed to get out of this 

quandary? 

Mr. SMITH. Let me just say I do not want to get into the privileged conversations that I have had with our employee. It is a darn 

complicated situation. Yeah, these are situations where people’s life 

and liberty ultimately is at stake. And, you know, we at Microsoft 

are not alone in having faced these kinds of issues around the 

world. And there are a number of companies facing similar issues 

in Brazil itself. And, you know, it, among other things, calls into 

question how one continues to do business in certain countries, 

whether people can continue to live there. You know, these are not 

easy decisions to make. 

Mr. GOWDY. Have you proposed either a legislative or regulatory 

remedy to the Department on how to resolve fact patterns like the 

Brazilian one? 

Mr. SMITH. Yes, and I have talked with the Brazilian Government as well as you might imagine. Ultimately, I believe that if the 

U.S. and the U.K. can fashion an agreement that works, the people 

in the United States can feel comfortable with, that law enforcement can feel meets its needs, it creates a model that we can consider then advancing in other countries. 

And I, frankly, hope there will a day when there is an agreement 

between the United States and Brazil as well. I think that that 

kind of solution is needed for the people of Brazil, and the Brazilian Government, who have legitimate needs I appreciate, but we 

just need a new solution, not an old one. 

Mr. GOWDY. I am almost out of time, so this will be my last question. Going back to when we were in law school and this expectation of privacy, and the fact that it has to be an expectation that 

the public considers to be reasonable, but the public can change its 

mind. So the bank records case from 30 years ago, or however old 

that was, if that is really the most recent precedent or the prece-
120 

dent that people cite for this, where do you see the public’s reasonable expectation in terms of what they think they have a privacy 

interest in? 

Mr. SMITH. I think technology has moved forward, public expectations of privacy have caught up, people actually do expect the 

data they store in the cloud and put on their devices to be private. 

And the Supreme Court, I think, recognized this unanimously 2 

years ago in the Riley case. And I thought the fact that it was a 

unanimous Supreme Court decision acknowledging this public expectation to privacy was of fundamental importance for the country. 

Mr. GOWDY. Thank you, Mr. Chairman. 

Mr. ISSA. Thank you, Mr. Chairman. We now go to the gentleman from New York, Mr. Jeffries. 

Mr. JEFFRIES. Thank you, Mr. Chairman. I thank all the witnesses for their presence here today. Let me start with Mr. Smith. 

Microsoft is a U.S.-based company in Washington that employs 

around tens of thousands of individuals in the country, is that fair 

to say? 

Mr. SMITH. That is correct. We employ more than 50,000 people 

in the United States. 

Mr. JEFFRIES. And other companies like Google and Apple and 

Facebook also employ tens of thousands of people here in the country? 

Mr. SMITH. Collectively our industry employs hundreds of thousands, indeed probably millions, of people in the United States. 

Mr. JEFFRIES. And it is projected, I think, over the next 5 years 

that at least a million, if not more, jobs will be created here in 

America as a result of the activity of technology innovation companies. 

Mr. SMITH. Assuming our country can give people the skills and 

education they need, absolutely we will create the jobs and fill 

them here. 

Mr. JEFFRIES. Now, collectively, companies like Microsoft and 

Apple and some of the others that I mentioned are sort of world 

leaders in the technology and innovation economy. Is that also a 

fair assessment? 

Mr. SMITH. That is what we aspire to be every day, yes. 

Mr. JEFFRIES. And I would be interested in your thoughts as to 

this notion that the trust factor, which has been eroding all across 

the world as it relates to the view that many other countries have 

toward our leading technology companies, could adversely impact 

our position as a world leader in technology and innovation. 

Mr. SMITH. It is, I just think, an imperative for the U.S. technology sector to restore trust in American technology. We really, 

over the last 3 years, since the Snowden disclosures, there has 

been a global conversation taking place about whether people can 

trust technology. And as a tech sector, we have been out taking 

new steps, including investments in end-to-end encryption to advance that kind of trust. And I just think it is fundamental to our 

ability to succeed globally in the future. 

Mr. JEFFRIES. Secretary Chertoff, could you comment in this 

trust dynamic and the notion of eroding American competitiveness? 
121 

Mr. CHERTOFF. Yeah, I would be delighted to, Congressman. I 

will give you an example of what happens when you do not have 

trust. It is not a surprise that some of the major Chinese companies that are involved in producing telecommunications and IT 

equipment have a bit of a trust problem around the world. And I 

think in the last couple of years they wanted to be—one of them 

wanted to be the backbone of the IT system in Australia, and the 

Australian government said no, they would not allow it because, 

again, there was a trust issue. 

I think we underestimate sometime the strategic value of the 

United States of the ability to have an IT system, and to produce 

products and services that people do trust, and are willing to rely 

upon and implement. And I think, you know, since the Snowden 

disclosures, the effort to rebuild trust by making sure that first of 

all we have clear processes about, you know, what the law is, what 

is private, under what circumstances it has to be turned over—I 

think that is critical to maintaining our competitive position and 

that has an effect not only on our, frankly, our jobs, but on our national security as well. 

Mr. JEFFRIES. Thank you. Mr. Smith, the Department of Justice 

seems to have taken a position that there are no existing conflicts 

of law. Is that your understanding of their position, or your understanding of what the actual landscape is at this moment in time? 

Mr. SMITH. It is clearly what Mr. Bitkower said this morning. I 

do not believe it is an accurate characterization of the issues in our 

lawsuit at the Second Circuit. We pointed out that there are serious issues and concerns involving the potential conflict between 

U.S. and Irish law. There is no Irish court decision that is yet on 

point, but I think that the issues are serious. 

As I have mentioned, in Europe the law will be clear. There will 

be a concrete conflict across Europe in 2 years. And fundamentally, 

the case is not about whether there is a conflict of laws. It is about 

whether the executive branch is exercising power that the Congress 

gave it in ECPA. 

Mr. JEFFRIES. Now are countries in other continents likely to follow the lead of the European Union and move in the direction that 

becomes more restrictive, countries on the Continent of South 

America, Africa, Asia? 

Mr. SMITH. We are following these regulatory and legal trends 

around the world. And what we are basically seeing is a number 

of governments considering or enacting new laws or regulations 

that, in some cases, are requiring data localization, and in other 

cases are considering or moving toward these kinds of so-called 

blocking statutes like the one I have referred to in the European 

Union; yes. 

Mr. JEFFRIES. Thank you. And lastly, Secretary Chertoff, the 

19th century was the century of the telegraph, the 20th century the 

century of the typewriter, and then the personal computer, 21st 

century, century of the smart phone, internet of things, who knows 

what other innovation will take place. There seems to be an emerging consensus from many colleagues on both sides of the aisle that 

Congress needs to step in, in this vacuum. 

My question is with the explosive growth of innovation and technology, which is a great thing, you know, how—it is difficult for 
122 

Congress to keep up with the changes in technology. But what 

framework should we take in looking to enact legislation that recognizes the fact that we want to create some certainty, but also 

flexibility in interpretation in order to capture the dramatic and 

rapid change of technology? 

Mr. CHERTOFF. I think that is a very important question, it is 

one that I am not going to be able to fully answer in the remaining 

time allotted. I would say this—I do think it is time for Congress, 

whether they do it by way of a commission or some other body, to 

really take a comprehensive look at the question of how the change 

in technology has affected a lot of our expectations. I would not legislate on a micromanagement level but I do think some general 

principles could be fleshed out. And just to give you one example, 

Mr. Smith talked about the Riley case. Much of our rule about privacy is based on the idea that we are thinking about when you 

search an object or a case, you are searching what is in the case. 

But in many ways when you now pick up a smart phone and you 

start to search the phone, what you are doing is you are taking a 

key to your house. And it is as if you are taking the key and walking over to someone’s house and searching the whole house. 

So as we think about the issue of, how do we deal with data that 

is remotely held I think there is a general set of principles that we 

could come up with that would not micromanage every situation, 

but would help give a framework for applying? 

Mr. JEFFRIES. Thank you, and I yield back. 

Mr. ISSA. I thank the gentleman. Now all you have left are the 

non-attorney, four attorneys behind me, that will undoubtedly 

question a lot of my questions, but rightfully so. You know, Secretary Chertoff, I am going to use you as part of it; I am going to 

use probably Mr. Smith as part of it. First question was, since you 

brought all of your props and they are all tangible old props do you 

view—as I asked the first panel—do you view that, in fact, what 

we need to do is write specifics, but write them based on the same 

principles that we had in the tangible world? That is a fair analysis, is it? Secretary, same thing. Because I mean I think that is 

the first thing. We are going to have to write legislation. Do we 

write it based on principles of the past that our Founders saw in 

the tangible world, and then find a way to make them versatile in 

a instantaneous transfer world? 

Mr. CHERTOFF. I would say the answer to that is yes, in the 

sense that the enduring principles are what we want to make sure 

are preserved. But without minimizing the fact that it is not simply 

a matter of translating, you know, what is physical to what is virtual. There are going to be some differences, but the values remain 

the same. 

Mr. ISSA. Well let me go over some of these values. And if I see 

a headshake no, I will call on you. Otherwise, we will assume that 

I have got some yeses on these, which I like to get to yes. You 

might have noticed that in the past. Principles that we need to do 

if we pass updated legislation; first of all, we need to deal with the 

predictability, not just in the United States, but around the world. 

We need to have a reciprocity concept at the time that we 

produce this legislation, because the rest of the world is looking to 

us for whether we will live by our rules when the shoe is on the 
123 

other foot. The American people need to have a notice of what their 

rights are, and likely, in most cases, a notice of the taking of their 

information. We know there are certain times that it will not happen. We need to deal with what nexus is in a virtual world; not 

just is it a U.S. person, but did it originate in the United States? 

Did it transfer through the United States? And so on. 

We are likely, I believe, as a principle to have to break into two 

parts; one is the criminal part, including national security, the 

other is civil. Because, again, I suspect that we are going to have 

a custody battle between two people, and yet records are going to 

be demanded from around the world. 

It seems like, back to the same point, there has to be an informed consent. In other words, today most of us have no idea 

whether or not the storage of some item might give us additional 

rights or might not. And I presume we are going to have to look 

at that from a standpoint of both law and treaty. One that I, because I am also on foreign affairs, I am become very familiar with 

is the principle that does not seem to exist here but clearly exists 

in Europe, the right to be forgotten is going to have to be addressed 

if we are going to have reciprocal agreements with other countries 

who truly believe that if you host something in another country, it 

will not eliminate the likelihood that you have to honor, let’s just 

say a European Union citizen, the right to disappear, which they 

are clearly working on. I have not got a no yet. 

Lastly, the expectation of privacy. It appears as though one of 

the most important things we are going to have to do is define 

what the American people can expect from data which is stored 

anywhere outside of their pocket in an inanimate object with no 

battery and a cloister of multiple different shrouds, so that it cannot possibly be energized remotely, and thus activated and taken. 

And, Mr. Chertoff, you were laughing because we all know exactly how that happens. So did I go through points you all agreed 

to? And it looks like I did. What did I leave out? What additional 

considerations should this Committee have in the record today as 

we look to what is obviously our primary jurisdiction and a long 

overdue look at the world as it exists electronically? And I will just 

go right down the list. 

Mr. SMITH. Well first I would say that you have shown once 

again what Abraham Lincoln first proved, you do not have to go 

to law school to have a great legal mind. I think you have captured 

the legal issues that the world needs to address and certainly this 

Congress needs to address. I do not think there is anything that 

you have left out or—let me put it another way—if Congress could 

answer the questions that you have posed, the whole world of technology and the world for people would be much better off. 

Mr. CHERTOFF. I really agree with that. I would say one thing, 

just not to be naive. You know, I think in our minds when we talk 

about the ability to reach a global accommodation, we are thinking 

of the Europeans, we are thinking of countries that are more or 

less kind of western style democracies. 

Mr. ISSA. But I serve on Foreign Affairs so I know that we are— 

we may all be created equally but we do not all think the same. 

Mr. CHERTOFF. Exactly. And I think when we deal, for example, 

with Russia, we are going to need to be realistic about that. But, 
124 

you know, if we can reach a reasonable set of agreements with a 

good deal of the globe, that would be a major, major step forward. 

Mr. ISSA. And so that is where the reciprocity may not be universal but at least the standards among those who have reciprocity 

would be universal. Mr. Kris. 

Mr. KRIS. Yeah, I agree. I thought that was an excellent summary of all of the issues that need to be addressed. 

Mr. ISSA. That is why I went last. 

Mr. KRIS. Instantiating them, you know, in all of the various digital and other settings is going to be, as you know, enormously 

challenging. The only additional point I would make is you have, 

I will call it an opportunity, before the end of 2017 to consider renewal of the FISA Amendments Act. And so that is, as an adjunct 

to this, another area in which you are going to want to, I think, 

harmonize your efforts. Thank you. 

Ms. DASKAL. So I echo the agreement with the incredible list. I 

would just add that when one is thinking about the relevant nexus, 

which you raised just now and you also raised in your earlier questions to Mr. Bitkower, and the analogies to tangible property, I 

think the analogies are right in the sense that it does not make 

sense for the United States to assert unilateral jurisdiction over everything everywhere in the world; that there is a concern about 

that. At the same time, I think it is worth thinking about other jurisdictional hooks other than location of data, given the differences 

between data and other forms of tangible property. 

Mr. ISSA. I think your point is good. And just as one Member of 

this Committee, I believe that is one of the challenges we face from 

a business standpoint. And I will put my recovering, hopefully, 

never fully recovered businessman’s hat on for a moment. 

And that is that we want the world to have an expectation that 

rule of law will exist for them, no matter where the data is. The 

data transfer or, let’s just take J.P. Morgan Chase; if they only 

have one server farm, or two server farms, and they are both in 

the United States that will not happen. But if it did, we do not 

want the world to believe they are disenfranchised and begin ordering balkanization. And I certainly think although that is not part 

of the principles of our Constitution here, it is good common sense 

that we have to find a solution that does not adversely affect business models, cause countries essentially to order, even if it is Russia, to order that you localize for some reason. 

Let me beg your indulgence; I have 4 minutes left on the Chairman’s mandate that we finish at 1:30. There is an elephant not in 

the room, which is the Apple case, but since I am bringing it into 

the room, I want to ask just a basic question, and I will start with 

Mr. Smith. Microsoft, you mentioned in your testimony, and in 

some of your answers, you are looking at end-to-end encryption for 

a multitude of products. Your products, if they do not now, will 

shortly un-encrypt, use data, re-encrypt as a matter of course because we now have the processing power that allows you to do that. 

Is that a fair statement? 

Mr. SMITH. Well we are certainly focused on implementing 

encryption. It was two and a half years ago we said we would implement encryption at rest, encryption in transit, encryption in 
125 

more scenarios. So I think fundamentally encryption is an important part of safeguarding people’s information for the future. 

Mr. ISSA. So is it fair to say that what Apple is dealing with— 

you mentioned you are going to submit an amicus brief—what 

Apple is dealing with, every software company, and probably every 

communication company, and perhaps most, if you will, social networking and even ecommerce companies, all are going to face similar questions to the one that Apple is facing today. 

Mr. SMITH. I think in one form or another, many, many technology companies in many, many countries are going to need to address these encryption issues. And certainly Apple’s case is an important example of one form of that. 

Mr. ISSA. And Secretary Chertoff, I am going to take advantage 

of the fact you have worn so many hats, and your knowing what 

FISA judges go through, knowing how the NSA provides information, knowing what the Central Intelligence—what their sources 

and methods historically have been. Let me just ask you a question 

in the open. Is not one of the most important tools that we have 

in going after terrorists and criminal networks, the lack of their 

predictability and knowledge of what we can or cannot break, what 

we do or do not know, and what we can or cannot find out? 

Mr. CHERTOFF. I think that is absolutely correct. And that is one 

of the things that was very damaging about Snowden is to some 

extent he at least put them on alert about certain things. 

Mr. ISSA. So when Apple and others say that ordering a predictable key encryption, a backdoor, guarantees that at least as to 

those who have complied with it, that the bad guys will know not 

to use that product. And if I think of sort of the entrepreneurial 

nature of criminals and terrorists, by definition will we not be begging them to take their millions or billions of dollars and use it to 

develop items that do not have a backdoor and, thus, reduce the 

chances that we are going to have commercial off the shelf software 

that we might be able to produce our own independent backdoors 

from time to time without their knowing it? 

Mr. CHERTOFF. I think you are absolutely right. One of the unfortunate things about this being a public dispute is that it pretty 

much guarantees that terrorists will now be looking to other tools. 

And, in fact, there was something in the paper recently about a 

manual they found or some kind of a document of ISIS folks going 

through what are the best encrypted technologies. Now sometimes 

they are wrong, and that works for us, but only if we keep it quiet. 

Mr. ISSA. Thank you. I want to thank all of our guests. You were 

great witnesses. It is exactly 1:30, and we stand adjourned. 

Ms. DASKAL. Thank you. 

[Whereupon, at 1:30 p.m., the Committee adjourned subject to 

the call of the Chair.] 

(127) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD
128 

*Note: The Committee did not receive a response from this witness before this hearing transcript was finalized in October 2016. 

Questions for the Record submitted to David Bitkower, Principal Deputy 

Assistant Attorney General United States Department of Justice* 
129 

f 
130 

Response to Questions for the Record from Brad Smith, 

President and Chief Legal Officer, Microsoft Corporation 
131 
132 
133 
134 
135 
136 
137 

f 
138 

*Note: The Committee did not receive a response from this witness before this hearing transcript was finalized in October 2016. 

Questions for the Record submitted to the Honorable Michael Chertoff, 

Co-Founder and Executive Chairman, The Chertoff Group* 
139 

f 
140 

Response to Questions for the Record from the Honorable David S. Kris, 

former Assistant Attorney General for National Security, United States 

Department of Justice 
141 
142 

f 
143 

Response to Questions for the Record from Jennifer Daskal, Assistant 

Professor, American University Washington College of Law 
144 
145 
146 
147 
148 

Æ