U.S. Authorities Get Access to Data Stored on Overseas Cloud Servers

U.S. Authorities Get Access to Data Stored on Overseas Cloud Servers

Spending bill signed by President Trump would help with criminal probes but raises privacy concerns

By John D. McKinnon March 23, 2018 1:54 p.m. ET

WASHINGTON—A $1.3 trillion spending deal that President Donald Trump signed Friday includes a measure that gives U.S. investigators access to data stored on overseas cloud servers, resolving a long-running legal battle between law enforcement and big tech companies.

But the measure drew widespread criticism from privacy and human-rights activists, who suggested U.S. tech companies—under pressure in Washington—had retreated on the issue. They also suggested the bill could leave data stored in the U.S. vulnerable to demands by authoritarian foreign governments.

The measure, known as the Cloud Act, would create a legal framework for resolving the frequent conflicts that have sprung up recently over the issue.

It would amend U.S. law to make clear that law-enforcement warrants can apply to data that U.S.-based tech companies store anywhere in the world. But the act also would give companies a right to challenge warrants in court based on privacy laws in the specific country where the data are stored.

It also would allow for bilateral agreements between the U.S. and other countries over how to deal with disputes in the future, including other countries’ requests for data in the U.S.

The issue has come up more frequently in recent years, as big U.S. tech companies have stored more data overseas. One problem fueling the conflicts is that the 1986 federal law in question, the Stored Communications Act, is ill-suited to current cross-border data-storage practices.

In one case pending before the Supreme Court, a federal appeals court sided with Microsoft Corp. in holding that warrants for customer data can’t be enforced on U.S. providers if the data are stored overseas.

The Justice Department and state attorneys general say the lower-court ruling has hindered investigations into an array of crimes, from narcotics trafficking to arson to child pornography. Electronic evidence is now critical to virtually every criminal investigation, they say.

But Microsoft, Alphabet Inc.’s Google unit and other technology companies have argued the Justice Department’s position would leave them caught in the middle between U.S. law-enforcement demands and their obligation to abide by privacy laws in foreign jurisdictions.

The Justice Department applied for a warrant requiring Microsoft to turn over email information from an account allegedly tied to illegal drug activity in the U.S. Microsoft handed over some account data that were stored in the U.S. but said it shouldn’t have to hand over the emails, which were stored on a server in Ireland.

The companies say the case ultimately could threaten American dominance in the $250 billion cloud-computing industry, because foreign clients won’t use U.S. firms if their data aren’t protected.

The enactment of the Cloud legislation might leave little for the Supreme Court to decide in the Microsoft case. When the court heard oral arguments in February, multiple justices said congressional intervention would be welcome.

"It would be good if Congress enacted legislation that modernized this,” Justice Samuel Alito said.

Tech groups criticized the new measure’s implications for privacy in several respects, casting it as a surrender of sorts in the wake of the Microsoft case.

"The Cloud Act is a disappointing outcome after so many human-rights groups weighed in on the Microsoft case at the U.S. Supreme Court,” said Marc Rotenberg, president of the Electronic Privacy Information Center.

EPIC and other groups had pushed for many updates to the 1980s-era privacy law, he said, “but they were ignored.” Greg Nojeim of the Center for Democracy and Technology said the deal gives the Justice Department too much leeway to open up U.S. data to authoritarian foreign governments.

“DOJ could use this legislation to diminish privacy rights world-wide, or to persuade other governments to raise their surveillance standards in order to qualify for an agreement,“ he said. ”We fear the U.S. Congress hasn’t done enough to require DOJ to make the right decisions.”

“The internet industry applauds Congress for including the Cloud Act in the omnibus spending bill,” said Melika Carroll, a senior vice president for the Internet Association, a trade group representing big tech companies. “It’s critical that we modernize U.S. privacy laws to reflect current realities of how data is stored around the world. Passing the Cloud Act will enable law enforcement to gather data stored abroad for the purposes of investigating serious crimes, while still protecting individual privacy rights.”

—Brent Kendall contributed to this article.


Popular posts from this blog

Report: World’s 1st remote brain surgery via 5G network performed in China

Visualizing The Power Of The World's Supercomputers

BMW traps alleged thief by remotely locking him in car