The CLOUD Act

In 2018, Congress passed the Clarifying Lawful Overseas Use of Data Act, the CLOUD Act, amending the Stored Communications Act. The CLOUD Act removed restrictions on U.S. companies’ responding directly to foreign countries investigating serious crimes.

The law allows the federal law enforcement officials to subpoena cloud data stored on servers located in foreign countries. The CLOUD Act authorizes the White House to reach agreements with foreign governments providing for a process to transfer data. State and the AG must confirm that the other country has adequate measures in place to protect the privacy of U.S.citizens’ data.

Budapest Convention on Cybercrime

In 2006, the United States Senate ratified the Budapest Convention on Cybercrime. In addition to criminalizing hacking, the Convention also provides a basis for law enforcement authorities to compel internal service providers to monitor an individual's internet activities in realtime. Article 20 states that:

Each Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to:

a. collect or record through the application of technical means on the territory of that Party, and

b. compel a service provider, within its existing technical capability:

i. to collect or record through the application of technical means on the territory of that Party; or

ii. to co-operate and assist the competent authorities in the collection or recording of,

traffic data, in real-time, associated with specified communications in its territory transmitted by means of a computer system.

Supreme Court Oral Argument in United States v. Microsoft Corp.

On February 27, 2018, oral argument took place before the Supreme Court of the United States in United States v. Microsoft Corp.. You can hear the audio of the argument and read the transcript here. As mentioned in the Tip of the Night for February 26, 2018, the case concerns whether or not the Stored Communications Act allows the government to issue a warrant to compel American companies to produce data it has stored in servers located in foreign countries. These are my notes on what I found most interesting about the argument.

Justice Sotomayor referred to a bill, called the CLOUD Act, being considered in Congress which would allow for such cross border discovery but also provide for certain restrictions that would avoid international conflicts. She wondered if the Court should bother changing the status quo when new legislation was imminent.

The government argued that the Budapest Cybercrime Treaty provides for courts to require to providers to produce data even if it's stored in a foreign jurisdiction, a position that Justice Sotomayor did not accept.

The government noted that Google and other data providers use algorithms to move information between different countries to maximize their data systems.

Justice Kennedy asked whether the focus should be on the location of data, or where the owner of data resides or the service provider has its business headquarters.

Justice Alito discussed a hypothetical in which the government had probable cause that there was evidence of a crime in emails stored by an American internet service provider:

"But the provider has chosen to store the data overseas and, in fact, in some instances, has actually broken it up into shards so that it's stored not just in one foreign country but in a number of foreign countries. Now what -- what happens in that situation? There is no way in which the information can be obtained except by pursuing MLATs [Mutual Legal Assistance Treaties] against multiple countries, a process that could -- that will take many months, maybe years? What happens?" [Tr. at p. 36-37].

Microsoft countered that neither it (nor Google) breaks emails into shards.

n response to a question from Justice Sotomayor, the Microsoft attorney discussed the actions it would need to take to comply with a warrant for data on its servers located in Ireland. A remote control hardware mechanism reads data off a hard drive, and then the data is sent in a package across hard wires to the United States. This Microsoft contends is a distinctly extraterritorial act and characterized it as a, "physical manifestations. Human intervention ti not required to access the data in Ireland. Microsoft actually referred to the use of robot. "A human being doesn't have to do it. It is a robot. And if you -­ if you sent a robot into a foreign land to seize evidence, it would certainly implicate foreign interests." [Tr. at 44-45]. Microsoft also noted that only 54 of the 60,000 data requests it receives from the U.S. government concern emails stored abroad.

In response to a question from Chief Justice Roberts about whether or not its position on the SCA would prevent the Government from getting a warrant for emails sent from one person in the United States to someone across the street that happened to be stored abroad, Microsoft emphasized that users who wanted to prevent the government from having access to their messages would use tools or apps that scramble communications.

Justtice Alito argued that the ability of service providers to move data around at will, and the fact that data does not really consist of a physical object caused the concept of territoriality to be strained.