Source: https://blogs.orrick.com/trustanchor/2018/04/09/the-cloud-act-explained/
Timestamp: 2019-01-21 10:45:18
Document Index: 88117206

Matched Legal Cases: ['§ 103', '§ 2510', '§ 2703', '§103', '§ 103', '§ 105']

The CLOUD Act, Explained | Trust Anchor
Robert Loeb, Brian Goldman, Emily Tabatabai and Alec SchierenbeckPosted on April 9, 2018
The Clarifying Lawful Overseas Use of Data (“CLOUD”) Act was enacted into law on March 23, 2018. The Act provides that U.S. law-enforcement orders issued under the Stored Communications Act (SCA) may reach certain data located in other countries – a key question in United States v. Microsoft Corporation, No. 17-2, a case argued before the Supreme Court on February 27.[1] Both the government and Microsoft recently agreed that the closely watched case is now moot following the CLOUD Act.
The CLOUD Act’s Effects on the Stored Communications Act
The CLOUD Act lays out the circumstances under which a “provider of electronic communication service or remote computing service” must comply with a U.S. law-enforcement order to disclose data within its “possession, custody, or control,” even when that data is “located … outside the United States.” CLOUD Act § 103(a).
Although the Act expands the geographic scope of the SCA, it does not change who is subject to SCA orders or what type of data is subject to U.S. law-enforcement requests under the SCA. As before the Act’s passage, the SCA applies only to providers of “electronic communications services” and “remote computing services” – generally businesses that offer email, electronic messaging, or cloud storage services to the public. 18 U.S.C. §§ 2510(15) (defining electronic communications services), 2711(2) (defining remote computing services).
Also unchanged is that the SCA only regulates access to the content of electronic communications and cloud-stored documents, as well as non-content data relating to electronic communications (like transmission records and user-account information), but not other types of personal or business data. The CLOUD Act simply clarifies that the SCA’s rules governing U.S. law-enforcement agents’ access to content and non-content information – such as the provision requiring that law enforcement obtain a warrant before demanding that email providers turn over private email content, 18 U.S.C. § 2703(a) – generally apply to data that is stored outside the United States as well.
The CLOUD Act’s Executive Agreements Will Provide Clarity for Providers
The centerpiece of the CLOUD Act is a provision allowing the U.S. to establish Executive Agreements under which law-enforcement agencies will be given reciprocal access to data held in each other’s countries in order to investigate and prosecute certain crimes.
Before the CLOUD Act, a U.S. provider subject to an order under the SCA seeking data stored overseas may have reasonably feared that complying with such a request could violate foreign law. That fear will only become more acute when the European Union’s General Data Protection Regulation (GDPR) enters force next month, as Article 48 of the GDPR prohibits the transfer of data outside the European Union for law enforcement purposes unless doing so is authorized under an international agreement, such as a mutual legal assistance treaty, between the EU and the requesting country.
Similarly, U.S. providers have been concerned that compliance with a foreign government’s request for data stored in the U.S. could violate providers’ privacy obligations under the SCA, which contains an exception for U.S. law-enforcement requests but not foreign requests. These potential conflicts of law don’t just place providers in a bind – they also have limited valid government attempts to obtain information in criminal investigations.
Under the international agreements envisioned by the CLOUD Act, the U.S. and participating foreign governments will lift restrictions on providers’ compliance with other countries’ legal requests, introducing a measure of clarity for providers who had increasingly been caught in the middle of irreconcilable legal obligations imposed by different jurisdictions.
A provider may move to modify or quash if it “reasonably believes”:
that the “customer or subscriber is not a U.S. person and does not reside in the U.S.,” and
that disclosure would “create a material risk that the provider would violate the laws” of the foreign government. CLOUD Act §103(b).
granting the challenge would serve “the interests of justice”; and
the customer or subscriber is not a U.S. person and does not reside in the U.S.
And for purposes of determining what “the interests of justice” require, the Act establishes specific factors for the court to consider, including: (i) the interests of the U.S. and foreign government, (ii) the likelihood and nature of the penalties that would be imposed, (iii) the person and provider’s connections to the U.S., or (iv) the importance of the information to the investigation, and the availability of other means to obtain the information. Id.
Where the data sought by U.S. law enforcement is not located in a country with which the U.S. has reached such an agreement – and no countries have yet done so – the CLOUD Act expressly preserves the right of a provider to challenge an SCA warrant under “common law … comity analysis.” CLOUD Act § 103(c). Indeed, in a recent filing in the Microsoft case at the Supreme Court, following the CLOUD Act’s passage the Department of Justice acknowledged that the “CLOUD Act does not affect the availability or application of a common-law comity analysis.”
With respect to foreign law-enforcement requests, before the CLOUD Act providers generally directed foreign law-enforcement agencies to submit requests for mutual legal assistance to the U.S. Department of Justice, so that the request would formally come from a U.S. law-enforcement agency and thus be subject to the SCA’s law-enforcement exception.
To address concerns raised by privacy and civil liberty advocates, the Act permits the U.S. to enter into an Executive Agreement with a foreign government only if the Attorney General and the Secretary of State certify to Congress that, among other things, the foreign government provides “robust substantive and procedural protections for privacy and civil liberties” and that it has adopted procedures to “minimize the acquisition, retention, and dissemination of information concerning United States persons.” CLOUD Act § 105. Congress is afforded 180 days to disapprove any agreement.
In another important concession to privacy advocates, the Act makes clear that the Executive Agreement cannot mandate that companies subject to a surveillance order be capable of decrypting data stored on its systems (i.e. an “encryption backdoor,” a concept embraced by some U.S. law enforcement officials, most notably by the FBI in the wake of the San Bernardino shooting).
Be for the purpose of obtaining information related to “serious crime, including terrorism.”
“Identify a specific person, account, address, or personal device.”
Be justified by “articulable and credible facts.”
Remain “subject to review or oversight by a court” or “other independent authority,” among other requirements.
Now that the CLOUD Act is in effect, providers of “electronic communications services” and “remote computing services” should be aware that data stored outside the United States may now be subject to requests under the Stored Communications Act and must plan accordingly.
When choosing where to store data, providers may consider whether a datacenter will be located in a country that has entered into an Executive Agreement with the United States (once such agreements are reached, likely beginning later this year). Such agreements will better insulate companies from the risk of encountering irreconcilable obligations under two different countries’ laws when faced with law-enforcement requests from either U.S. or foreign law-enforcement agencies.
This entry was posted in Client Alert and tagged Cloud Computing, cloud services, EU Privacy, Law Enforcement, Stored Communications Act, The CLOUD Act. Bookmark the permalink.
← SEC Commissioners Provide Guidance on Cybersecurity Disclosures After Wave of Record Incidents
FTC’s Report on Mobile-Device-Security-Update Practices — Summary and Recommendations →