Cross-Border Data Sharing Under the CLOUD Act
Released: 2018-04-23T00:00:00

L aw enforcement officials in the United States and abroad increasingly seek access to electronic communications, such as emails and social media posts, stored on servers and in data centers located in foreign countries. The architecture of the internet allows technology companies significant flexibility as to the geographic location where they may store collected data. As a result, electronic communications that may be evidence of a crime are not necessarily housed in the same country where the crime occurred. This disconnect has caused governments around the world, including the United States, to seek data stored outside their territorial jurisdictions in the course of law enforcement investigations. It also has led to debate over the extent to which national governments can compel private companies to disclose data stored in foreign nations and the degree to which civil liberties and privacy concerns should inform the proper procedure for sharing such data.

In the United States, this debate largely has centered on the Stored Communications Act (SCA), which is part of the broader Electronic Communications Privacy Act (ECPA). Although the SCA generally prohibits certain technology companies from disclosing the contents of electronic communications to third parties, it mandates disclosure to the U.S. government pursuant to a warrant based on probable cause that the communications contain evidence of a crime. In United States v. Microsoft Corp. , the Supreme Court was set to address whether the United States could compel Microsoft to release emails housed in a data center in Ireland through a warrant issued under the SCA. But less than one month after oral argument, Congress passed and the President signed into law the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) as part of the Consolidated Appropriations Act, 2018. The CLOUD Act amends the SCA and requires service providers subject to the SCA to release data in their possession, custody, or control in response to an SCA warrant—regardless of whether the data is located in the United States. After the U.S. government obtained a new warrant for the emails held in Ireland under the authority of the CLOUD Act, the Supreme Court deemed Microsoft moot.

A second facet of the CLOUD Act addresses the reciprocal issue of foreign governments' desire to access data in the United States as part of their investigation and prosecution of crimes. Prior to the CLOUD Act, foreign nations seeking data in the United States generally were required to request the assistance of the U.S. government through either procedures established by mutual legal assistance treaties (MLATs) or judicial requests known as letters rogatory. Requests under either instrument are reviewed by U.S. courts before disclosure to the foreign nation is authorized, but U.S. and foreign officials have criticized these processes as inefficient and unable to accommodate the increasing cross-border data demands in the digital era.

The CLOUD Act responds to calls for modernization by authorizing the executive branch to conclude a new form of international agreement through which select foreign governments can seek data directly from U.S. technology companies without undergoing individualized review by the U.S. government. Agreements authorized by the CLOUD Act would remove legal restrictions on certain foreign nations' ability to seek data directly from U.S. providers in cases involving "serious crimes" when not targeting U.S. persons, provided that the United States has determined that the foreign nation's laws adequately protect privacy and civil liberties, among other requirements.

This report reviews the development of cross-border data sharing laws in criminal matters in the United States. It begins with an overview of ECPA and the SCA. Next, the report discusses the questions raised in the Microsoft litigation and the impact of the CLOUD Act on those issues. Finally, the report examines the new form of international agreements authorized by the CLOUD Act and the commentary on the benefits and drawbacks of the potential new international data sharing agreements.

Overview of ECPA and the SCA

Enacted in 1986, ECPA is one of the primary federal laws regulating disclosure of electronic communications held by private entities. ECPA is structured on three main titles. Title I, commonly referred to as the Wiretap Act, governs the interception of real-time wire, oral, or electronic communications. Title II added a new chapter to the United States Code entitled "Stored Wire and Electronic Communications and Transactional Records Access," and generally is referred to as the Stored Communications Act or SCA. The SCA applies to many forms of electronic communications and associated data, including emails; text messages; private messages, wall postings, and other comments made on or via social media sites; and private YouTube videos. Title III of ECPA regulates the use of a pen register, a device that allows users to capture the routing information associated with communications, such as telephone numbers dialed. Each title in ECPA contains restrictions on the circumstances in which the relevant data can be used or disclosed.

As technology has evolved since ECPA's enactment in 1986, law enforcement has shifted its primary focus from the interception of live communications pursuant to the Wiretap Act to seeking the now-common forms of stored communications governed by the SCA. But the SCA does not apply the same provisions to every communication or data that falls under its ambit. Rather, the scope of the SCA may be impacted by whether the law is applied to a provider of "electronic communication services" (ECS) or "remote computing services" (RCS). Although some SCA requirements vary depending on the provider, the act has two core components that apply to both forms of provider: (1) prohibitions on disclosure of certain data and (2) mandatory disclosure provisions.

Prohibitions on Disclosure Under the SCA

The first facet of the SCA is a restriction on providers' ability to share customers' electronic communications and their related records and information. Restrictions differ depending on the data at issue. For the contents of electronic communications (e.g., the body of an email), the SCA prohibits disclosure to "any person or entity," absent an exception, provided certain technical requirements are met. The SCA also prohibits both categories of provider from disclosing a "record or other information pertaining to a subscriber to or customer of such service" to the U.S. government. This prohibition, which concerns non-content information or "metadata," does not prohibit disclosure to private entities or foreign governments. The SCA enumerates several exceptions to the prohibition on disclosure of both content and non-content communications.

Mandatory Disclosure Under the SCA

The second major component of the SCA is its rules that require providers to disclose customer communications and related records to the U.S. government. The SCA establishes a tiered system with differing procedures and standards governing when the U.S. government can demand that providers divulge stored communications. As described below, the SCA's standards for mandatory disclosure depend on a number of factors, including, among other things, the type of data sought; whether an ECS or RCS holds the data; the length of time the data has been stored; whether the data is content or non-content; and whether advanced notice has been given to the customer. The multitude of relevant factors can make the determination of whether disclosure is mandatory a complex and fact-specific evaluation.

At the highest level, the SCA requires the U.S. government to obtain a warrant if the government seeks access from an ECS provider to the content of a communication that has been in "electronic storage" for 180 days or less. A warrant may be issued only if the U.S. government demonstrates probable cause that the communications sought establish evidence of a crime. If the communication has been stored for longer than 180 days, or if it is being "held or maintained" by an RCS "solely for the purpose of providing storage or computer processing services," the government can use a subpoena or a court order under 18 U.S.C. § 2703(d), provided notice is given to the customer. To obtain an order under this section—known as a Section 2703(d) order—the applicant must prove "specific and articulable facts, showing that there are reasonable grounds to believe that the contents of a[n] . . . electronic communication . . . are relevant and material to an ongoing criminal investigation."

In addition to the content of communications, the SCA permits access to non-content information with a warrant, but the government also may use a subpoena or a Section 2703(d) order to provide the customer notice. To access basic subscriber information, including the customer's name, address, phone number, length of service, and means of payment (including bank account numbers), the government may follow the more stringent requirements for obtaining a warrant or a Section 2703(d) order, but it also can use an administrative subpoena, which requires no prior authorization by a judicial officer or notice to the customer.

United States v. Microsoft Corp. and the CLOUD Act

While the complexities of the SCA coupled with major changes in technology have led some to call for broad reforms to the law, one discrete issue—the extraterritorial application of the SCA—became the subject of particular interest as a result of a 2016 federal appellate court decision. As noted above, the SCA mandates that service providers disclose the content of electronic communications when the government obtains a warrant based on probable cause. In 2013, federal law enforcement officials sought an SCA warrant requiring Microsoft to disclose all emails and other information associated with an account with one of its customers. After finding that the United States demonstrated probable cause that the account was being used to further illegal drug trafficking, a United States magistrate judge issued a warrant requiring Microsoft to disclose the contents of an email account and all records or information associated with the account "[t]o the extent that the information . . . is within [Microsoft's] possession, custody, or control."

Microsoft complied with the portion of the warrant seeking metadata about the user's account (e.g., the name, IP address, and telephone number associated with the account), which was stored in the United States, but it determined that the contents of the user's emails were held in a data center in Dublin, Ireland. Microsoft stores its users' emails in one of its many data centers around the world—most often the one closest to where users state they are from when signing up for the email service. Although Microsoft did not dispute that it had the ability to access the emails in Ireland using computers inside the United States, it declined to comply with the portion of the warrant seeking data stored overseas on the ground that the SCA's mandatory disclosure provisions did not apply extraterritorially.

The district court initially overruled Microsoft's objections, and it held the company in civil contempt for failing to produce the emails. But the U.S. Court of Appeals for the Second Circuit (Second Circuit) reversed those rulings in 2016. Relying on the presumption established by the Supreme Court that U.S. laws do not have effect outside U.S. territorial jurisdiction unless the law specifies otherwise, the Second Circuit held that the SCA does not authorize the seizure of emails stored exclusively on foreign servers. The United States appealed the Second Circuit's decision, and the Supreme Court granted certiorari in 2017 in United States v. Microsoft , Corp. —a widely followed case that drew attention and amici curie briefs from a range of groups including privacy advocates, law enforcement officials, Members of Congress, 34 U.S. states and territories, and several foreign nations.

The Legislative Response to Microsoft in the CLOUD Act

While the Microsoft appeal was pending before the Supreme Court, officials from the Department of Justice (DOJ) sought a legislative response to the Second Circuit's ruling. In a hearing before the House Committee on the Judiciary in June 2017, DOJ representatives argued that the Second Circuit's decision "effectively hamstrung the ability of law enforcement" to obtain data stored by U.S. service providers abroad, creating a "tremendous problem" that caused "substantial harm to public safety. " Accordingly, DOJ proposed a draft bill that would amend provisions in ECPA, including provisions in the SCA, to state expressly that a service provider must comply with the law's mandatory disclosure requirements when the data is in the provider's possession, custody, or control—regardless of whether the data is located inside the United States. As described by DOJ, the proposal was intended to restore the "pre- Microsoft status quo when providers routinely complied" with SCA warrants for data stored abroad.

In February 2018, identical bills—both titled the CLOUD Act—containing DOJ's proposed extraterritoriality provision were introduced in the House and Senate. The CLOUD Act was included in the Consolidated Appropriations Act, 2018, which was passed by both chambers, and signed into law by the President on March 23, 2018. As enacted, the CLOUD Act amends ECPA by, among other things, including the following extraterritoriality provision:

A [provider] shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.

After the CLOUD Act's enactment, the United States obtained a new warrant seeking the emails at issue in its dispute with Microsoft under the authority of the new law. Because both the United States and Microsoft agreed that the new warrant replaced the prior warrant, the Supreme Court concluded that the case had become moot, and vacated the lower court's rulings with instructions to dismiss.

Resolving Conflicts with Foreign Law

In addition to defining the extraterritorial reach of the mandatory disclosure provisions in ECPA, including the SCA, the CLOUD Act contains provisions designed to resolve potential conflicts of law that could arise if the United States seeks data stored abroad when the law of a foreign country prohibits disclosure. It does so by authorizing a provider to file a motion to quash or modify a data demand if

the provider reasonably believes the target of the demand is not a U.S. person and does not reside in the United States; the provider reasonably believes disclosure would create a material risk of violating a foreign nation's law; and the foreign nation whose law may be violated has a data sharing agreement with the United States authorized by the CLOUD Act (discussed in more detail below ).

A court may grant the providers' motion to modify or quash a government demand for data upon finding that three conditions are met: (1) the required disclosure would violate foreign law; (2) the interests of justice dictate that the demand should be quashed or changed; and (3) the target is not a U.S. person and does not reside in the United States. In determining whether the second condition is satisfied, courts must undertake a "comity analysis." Comity—or respect for foreign sovereignty — is a legal doctrine that, among other things, permits courts to excuse violations of U.S. law, or moderate the sanctions imposed for such violations, when the violations are compelled by a foreign nation's law. Courts and commentators often have described the comity doctrine as vague and ill-defined, but the CLOUD Act specifically enumerates the factors courts should consider when determining whether comity principles support quashing or modifying a data demand.

Notably, however, the CLOUD Act's comity factors and statutory right to a file a motion to quash or modify apply only to nations with which the United States has a data sharing agreement, as discussed below. For nations with no such agreement, the CLOUD Act preserves common law principles of comity. Common law comity principles generally dictate that U.S. legal obligations can be avoided as a result of foreign law only when the person or entity in question acted in good faith to avoid the conflict, but there remains a likelihood of severe sanctions in the foreign nation for failure to comply with foreign law. Ultimately, the comity analysis under either the CLOUD Act or common law principles is likely to be a highly fact-specific evaluation that depends on the specific circumstances of a demand for data stored overseas.

International Data Sharing After the CLOUD Act

In addition to expressly expanding the ability of the U.S. government to require service providers to release data stored outside the United States, the CLOUD Act addresses a reciprocal issue: limitations on foreign governments' ability to obtain data in the United States. As internet-based communications have become commonplace, evidence of criminal conduct frequently is derived from data stored on servers located outside the territorial jurisdiction of the nation where the crime was committed. Because technology companies headquartered in the United States hold a majority of the world's electronic communications on their servers, foreign governments frequently seek data held by U.S. companies. At the same time, ECPA prohibits service providers from disclosing the content of electronic communications directly to foreign governments absent a statutory exception or a warrant from a federal court.

With ECPA acting as a "blocking statute" that prevents foreign governments from directly acquiring certain third-party data stored by private entities in the United States, foreign nations have sought the U.S. government's assistance in obtaining warrants that authorize disclosure. Prior to the CLOUD Act, there were two common international legal processes for obtaining a warrant in the United States: letters rogatory requests and MLATs.

Letters Rogatory

Letters rogatory are requests made by a court in one nation to the court of another nation seeking assistance in obtaining evidence located abroad. Historically, letters rogatory were the principle mechanism for sharing evidence between nations. Whereas MLATs and agreements authorized under the CLOUD Act generally are limited to government-to-government requests in criminal cases (with some exceptions in early MLATs), criminal defendants and private litigants in civil cases may request that U.S. courts issue letters rogatory. Governments may also use letters rogatory to seek judicial assistance in obtaining evidence abroad when the United States does not have either an MLAT or a CLOUD Act agreement with a foreign nation .

Letters rogatory are discretionary requests premised on principles of comity rather than an obligation under international law. There is no legal obligation or guarantee that the country receiving the request will respond, and the evidence sharing process has been described as time-consuming and unpredictable . Consequently, letters rogatory are often seen as the least preferable method of obtaining evidence abroad.

Mutual Legal Assistance Treaties (MLATs)

As investigations into complex, coordinated international crimes like money laundering and drug trafficking became more common in the 1970s, the United States and other nations began to enter into MLATs, which established standardized procedures for sharing of certain evidence across national boundaries in criminal matters. MLATs are treaties—most often bilateral treaties—in which nations agree to provide certain assistance to foreign governments in the investigation and prosecution of crimes. Whereas letters rogatory are discretionary requests, MLATs create treaty-based obligations governed by international law.

While the requirements in each MLAT may differ depending on the specific terms of the treaty, MLATs generally obligate nations to summon witnesses, compel the production of documents and other evidence, issue warrants, and serve process in response to requests from the foreign government. MLATs typically also identify grounds for refusing requests. The United States has MLATs with more than 60 nations, but this accounts for less than half the nations in the world.

Each party to an MLAT designates a central authority through which direct communications can be made. The central authority for the United States is the Office of International Affairs (OIA) in the Criminal Division of DOJ. When a request for legal assistance is submitted to the United States, OIA receives and conducts an initial review to ensure that the request contains all necessary information and comports with required formats. OIA then transmits the request to the U.S. Attorney in the jurisdiction where the witness or evidence is located. The U.S. Attorney brings the request before a federal district court by filing a request for a court order or warrant authorizing the United States to carry out the action sought by the foreign nation. Before authorizing the action, courts review the request to ensure that it complies with the underlying treaty and U.S. law and constitutional requirements. After a warrant or court order has been issued and the provider transfers the data to the U.S. government, OIA and the Federal Bureau of Investigation (FBI) review the material in an effort to minimize production of information that is not responsive to the request.

According to the 2013 President's Review Group on Intelligence and Communications Technologies, MLAT requests submitted to the United States take an average of approximately 10 months to complete. When the United States seeks data from foreign nations, some requests take "considerably longer," especially when submitted to countries that are uncooperative or have less sophisticated legal systems. According to one U.S. official, the United States never receives a response to some requests.

Executive Agreements Authorized by the CLOUD Act

Although the MLAT process generally is seen as more predictable and efficient than letters rogatory, MLATs became the subject of criticism in recent years due to, among other things, the typical length of response time under such agreements and the fact that the United States does not have any MLAT with more than half the nations in the world. At the same time, the number of requests for assistance in obtaining data and other evidence in the United States has increased markedly. In its FY2017 budget request, DOJ stated that the number of requests for judicial assistance from foreign countries increased nearly 85%, and the number for requests for "computer records" increased over 1000%.

As foreign governments' need for data located overseas has expanded, some nations have sought data directly from U.S. providers and passed legislation authorizing their governments to compel disclosure. These developments have placed U.S. technology companies at the intersection of potentially conflicting legal obligations: service providers may be both subject to foreign court orders compelling the release of data and prohibited by U.S. law from disclosing that data. The potentially conflicting obligations coupled with criticisms of the MLAT and letters rogatory processes led to proposals for changes in the international data sharing regime that ultimately culminated in the CLOUD Act.

The CLOUD Act creates a third paradigm of international data sharing arrangements: the possibility of international agreements that remove legal restrictions on U.S. technology companies' ability to disclose data directly to certain foreign nations in response to "orders" issued by foreign nations. Whereas MLATs are "treaties" within the meaning of U.S. constitutional law—meaning they are binding international agreements concluded by the Executive after receiving the advice and consent of the Senate as provided in the Treaty Clause —the CLOUD Act authorizes the United States to enter "executive agreements" with qualifying foreign nations. Executive agreements are binding international agreements entered into by the Executive based on a source of authority other than the Treaty Clause. The Executive's authority often is derived from legislation, as is the case in the CLOUD Act.

The executive agreements authorized under the CLOUD Act would allow service providers to disclose the contents of electronic communications—both stored communications and real-time communications intercepted by wiretap—directly to requesting foreign governments with whom the United States has an authorized data sharing agreement. The act does so by removing ECPA's prohibitions on disclosure to such foreign governments. When a foreign nation with a CLOUD Act agreement issues an "order" seeking data from a provider in the United States, the provider can deliver the requested data without civil or criminal penalty under ECPA. By contrast, in the MLAT and letters rogatory processes, cross-border data requests initially are submitted to government entities rather than to the private party in possession of the data.

Although the CLOUD Act authorizes executive agreements that would remove ECPA's prohibitions on disclosure, neither the act nor the agreements it authorizes create a legal obligation for service providers to comply with foreign governments' data demands. Rather, a foreign government's authority to issue an order seeking data must derive solely from its domestic law. Additionally, state or federal laws other than ECPA still may prohibit disclosure of particular classes of information.

Requirements for CLOUD Act Agreements

The CLOUD Act contains a number of restrictions on the type of foreign governments with whom the United States can enter agreements and the nature of demands for data that qualifying foreign governments can issue to U.S. providers. Before an agreement concluded under the CLOUD Act can enter into force, the Attorney General, with the concurrence of the Secretary of State, must make four written certifications that are provided to Congress and published in the Federal Register :

1. the foreign nation's domestic law "affords robust substantive and procedural protections for privacy and civil liberties" in its data-collection activities, as determined based on at least seven statutory factors; 2. the foreign government has adopted "appropriate" procedures to minimize the acquisition, retention, and dissemination of information concerning U.S. persons; 3. the executive agreement will not create an obligation that providers be capable of decrypting data, nor will it create a limitation that prevents providers from decryption; and 4. the executive agreement will require that any order issued under its terms will be subject to an additional set of procedural and substantive requirements, as discussed below.

The CLOUD Act expressly states that these certifications are not subject to judicial or administrative review. But the act gives Congress the power to prevent a proposed executive agreement from entering into force through expedited congressional review provisions after the certifications are provided. Certifications must be renewed every five years, and recertifications trigger Congress's power to block renewal through expedited review processes. Additionally, if requested by the Committees on the Judiciary or Foreign Affairs in the House or the Committees on the Judiciary or Foreign Relations in the Senate, the executive branch must furnish to the requesting committee a summary of the factors it considered when determining that a foreign government satisfies the CLOUD Act's requirements.

Limitations on Orders Issued Under CLOUD Act Agreements

The fourth certification required by the CLOUD Act mandates that any data sharing agreement concluded under the act contain a set of requirements related to foreign governments' orders issued to service providers. These include, among things, requirements that all orders

identify a specific person, account, or other identifier that is the object of the order; be premised on a "reasonable justification based on articulable and credible facts, particularity, and severity regarding the conduct under investigation"; not intentionally target a U.S. person (or person located in the U.S.) or target a non-U.S. person with the intention of obtaining information about a U.S. person; be issued for the purpose of obtaining information relating to the prevention, detection, investigation, or prosecution or a "serious "crime"—a term that the CLOUD Act states includes terrorism, but otherwise does not define; comply with the domestic law of the issuing country; not be used to infringe freedom of speech; and satisfy additional requirements for real-time communications captured by wiretap.

When a foreign government receives the requested data from the provider, it must promptly review the material and store any unviewed communications on a "secure system accessible only to those trained in applicable procedures . . . ." The "applicable procedures" must, to the maximum extent possible, comply with the minimization procedures in Section 101 of the Foreign Intelligence Surveillance Act (FISA). Foreign governments may not issue an order at the request of the United States or any third-party government, and they may not disclose the content of communications of a U.S. person to the U.S. government except in cases involving significant harm or threat of harm to the United States or U.S. persons.

Mandatory Rights Granted to the United States

The CLOUD Act requires that data sharing agreements grant certain powers to the U.S. government. Specifically, the foreign government must grant reciprocal rights of data access to the United States and allow the U.S. government to conduct periodic reviews of the foreign nation's compliance with the terms of the executive agreement. CLOUD Act agreements also must reserve the United States' right to "render the agreement inapplicable" for any order for which the United States concludes the agreement "may not properly be invoked."

Judicial or Governmental Review of Orders Under CLOUD Act Agreements

The process for judicial or other government oversight of foreign nations' requests for data under the CLOUD Act differs from earlier international data sharing regimes. In both the MLAT and letters rogatory processes, a federal court reviews and approves a foreign government's request for information before issuing a warrant or court order. Such requests generally must satisfy U.S. legal standards and constitutional requirements, such as the Fourth Amendment probable cause standard. Several federal appellate courts have stated that an otherwise valid MLAT or letters rogatory request may be rejected if compliance would result in a violation of the Constitution. For MLAT requests, agencies in the executive branch conduct additional reviews for compliance with U.S. law before and after receiving judicial approval to execute a cross-border data request.

Under CLOUD Act agreements, by contrast, foreign governments can submit orders directly on service providers. While those orders are "subject to review or oversight by a court, judge, magistrate, or other independent authority" in the foreign nation , the CLOUD Act does not require review or approval by a U.S. court or federal agency. And unlike MLATs and letters rogatory, the CLOUD Act contemplates that the judicial or other independent review in the foreign country could occur after a foreign government issued an order to a service provider. The ultimate result is that foreign nations' orders issued under the CLOUD Act are not required to undergo individualized review by any branch of the U.S. government, and U.S. courts are not required to analyze whether the foreign government's request complies with U.S. constitutional standards. This change appears to be intended to accelerate the data sharing process, especially in cases involving emergency or other time-sensitive requests. Rather than review each request individually, the United States' opportunity to scrutinize a foreign country's data demands primarily will occur during the periodic review of a foreign nation's compliance with its data sharing agreements and when evaluating whether a foreign nation's laws satisfy the CLOUD Act's eligibility requirements.

What Nations Are Eligible for CLOUD Act Agreements?

The CLOUD Act does not specify by name what countries meet its requirements, and the Attorney General has not provided the requisite certifications for a proposed agreement as of the date of this report. Consequently, it is not clear which, if any, nations may be eligible for CLOUD Act agreements. However, in 2016, DOJ informed Congress that the United States sought legislation that would implement a potential bilateral data sharing agreement with the United Kingdom. While the draft bilateral agreement has not been made public, DOJ proposed legislation that the department stated was necessary to implement the potential agreement. The structure and many provisions of the CLOUD Act appear to have been derived—and in some cases taken verbatim—from DOJ's proposed legislation. Some commentators believe that the U.S.-U.K. agreement will be the first agreement to be certified by the executive branch and submitted to Congress for review under the CLOUD Act's expedited congressional review procedures, as discussed below.

Congressional Review of CLOUD Act Agreements

The CLOUD Act provides for a mandatory 180-day period of congressional review before a proposed data sharing agreement can enter into force. The act also defines a number of procedures authorizing congressional consideration of a joint resolution of disapproval of an executive agreement on an expedited process. The procedures include among other things, automatic discharge of the congressional committees to whom the joint resolution has been referred within 120 days; waiver of certain points of order; limitations on and structuring of debate; and expedited treatment of a joint resolution received from the other chamber of Congress.

If Congress enacts a joint resolution of disapproval during the 180-day review window, the CLOUD Act states that the proposed agreement may not enter into force. Such a joint resolution of disapproval would require passage by both chambers of Congress and the President's signature or a veto override. Because the CLOUD Act provides that proposed data sharing agreements will be submitted to Congress after already receiving the approval of two Cabinet-level executive officials—the Attorney General and Secretary of State—some commentators contend that a President would be unlikely to sign a joint resolution of disapproval, making a veto-proof majority necessary to block a proposed CLOUD Act agreement.

Commentary on the CLOUD Act

The CLOUD Act has garnered both praise and criticism from observers. Some argue that the act provides a practical remedy for problems related to the globalization of evidence and the increased demand for data stored overseas in criminal cases. Supporters assert that the need for data stored abroad, which often is held by U.S. internet companies, has overburdened the legal architecture established in the MLAT and letters rogatory systems, rendering those systems "outdated and inefficient." Supporters also argue that the CLOUD Act provides adequate protection for privacy, civil liberties, and human rights. They contend that, absent the change in law, frustrated foreign governments that are unable to obtain data held by U.S. companies will exert extraterritorial application of their own laws or enact data localization laws that some believe impede the effective functioning of an open internet. Several major U.S. technology companies—including Apple, Facebook, Google, Microsoft, and Oath—support the legislation, calling it an effective legislative solution that reduces conflicts of laws.

Critics of the CLOUD Act argue that it poses a threat to civil liberties and human rights by lowering the standards previously necessary to obtain evidence in cross-border criminal investigations and prosecutions. They contend that the CLOUD Act's standard for individualized suspicion—"reasonable justification based on articulable and credible facts, particularity, legality, and severity regarding the conduct under investigation"—is vague and may not rise to the level of probable cause necessary to obtain a judicial warrant under U.S. law. Some argue that the executive branch's decision to certify a country as satisfying the CLOUD Act's standards should be subject to judicial or other review. Others contend that the concept that foreign nations' data requests do not need individualized review if the nations' domestic laws meet the act's eligibility criteria is flawed because foreign governments' real-world operations may not comport with their domestic laws and may change over time. Several critics of the CLOUD Act argue that it should require a foreign court or independent authority to approve a foreign government's order before the order is issued on a U.S. provider. Others contend, among other things, that the law should increase the requirements for foreign governments to obtain access to real-time communications to the same standards that apply to the United States' interception of live communications in the Wiretap Act.

How Will CLOUD Act Agreements Interact with Existing Data Sharing Processes?

Executive agreements authorized by the CLOUD Act would supplement, not replace, existing avenues of international data sharing. Accordingly, requests for assistance would still be available through MLATs (when in effect) and letters rogatory.

When analyzed in light of existing data sharing processes, the CLOUD Act has the potential to result in a three-tiered system for cross-border data sharing in criminal matters. Those nations that are approved for CLOUD Act agreements could request data directly from U.S. service providers in cases involving "serious crimes"—provided they do not target U.S. persons or persons located in the United States and meet the CLOUD Act's other requirements. For nations that have an MLAT but no CLOUD Act agreement, or for data requests that fall outside the scope of the CLOUD Act, foreign governments can use the MLAT process. Finally, private litigants and nations that do not have a CLOUD Act agreement or an MLAT may request that their courts issue letters rogatory to the courts of the United States.

Conclusion

While the CLOUD Act is likely to more clearly define the scope of U.S. officials' right to seek certain data stored overseas in the custody of U.S. providers, its broader impact on the international data sharing regime is less certain. As the internet continues to expand and become more globalized, law enforcement officials worldwide can be expected to continue to seek access to data stored on servers outside their territorial jurisdictions. Although the major technology companies responsible for maintaining a large share of the world's data are located in the United States, the United States accounts for less than 10% of the estimated 3 billion internet users worldwide. These demographics potentially could lead many nations to pursue CLOUD Act agreements, which would provide faster access to data held by U.S. providers. Whether the United States ultimately enters such agreements will depend on the willingness of the executive branch to certify foreign nations' eligibility and Congress's desire to block a proposed agreement through a joint resolution of disapproval enacted into law.

The impact of the CLOUD Act on privacy, human rights, and civil liberties interests similarly is difficult to predict. The act has the potential to create a three-tiered system of international data sharing, with the United States' most trusted foreign partners able to obtain data directly from U.S. companies without individualized review by the U.S. government. Because this system of direct access differs from existing international data sharing regimes, the manner in which data requests are administered, the type of data that is collected, and the degree of potential for abuse of the system, if any, may become more apparent over time.