U.S. Authorities Get Access to Data Stored on Overseas Cloud Servers
U.S. Authorities Get Access to Data Stored on Overseas
Cloud Servers
Spending bill signed by President Trump would help with
criminal probes but raises privacy concerns
By John D. McKinnon March 23, 2018 1:54 p.m. ET
WASHINGTON—A $1.3 trillion spending deal that President
Donald Trump signed Friday includes a measure that gives U.S. investigators
access to data stored on overseas cloud servers, resolving a long-running legal
battle between law enforcement and big tech companies.
But the measure drew widespread criticism from privacy
and human-rights activists, who suggested U.S. tech companies—under pressure in
Washington—had retreated on the issue. They also suggested the bill could leave
data stored in the U.S. vulnerable to demands by authoritarian foreign
governments.
The measure, known as the Cloud Act, would create a legal
framework for resolving the frequent conflicts that have sprung up recently
over the issue.
It would amend U.S. law to make clear that
law-enforcement warrants can apply to data that U.S.-based tech companies store
anywhere in the world. But the act also would give companies a right to
challenge warrants in court based on privacy laws in the specific country where
the data are stored.
It also would allow for bilateral agreements between the
U.S. and other countries over how to deal with disputes in the future,
including other countries’ requests for data in the U.S.
The issue has come up more frequently in recent years, as
big U.S. tech companies have stored more data overseas. One problem fueling the
conflicts is that the 1986 federal law in question, the Stored Communications
Act, is ill-suited to current cross-border data-storage practices.
In one case pending before the Supreme Court, a federal
appeals court sided with Microsoft Corp. in holding that warrants for customer
data can’t be enforced on U.S. providers if the data are stored overseas.
The Justice Department and state attorneys general say
the lower-court ruling has hindered investigations into an array of crimes,
from narcotics trafficking to arson to child pornography. Electronic evidence
is now critical to virtually every criminal investigation, they say.
But Microsoft, Alphabet Inc.’s Google unit and other
technology companies have argued the Justice Department’s position would leave
them caught in the middle between U.S. law-enforcement demands and their
obligation to abide by privacy laws in foreign jurisdictions.
The Justice Department applied for a warrant requiring
Microsoft to turn over email information from an account allegedly tied to
illegal drug activity in the U.S. Microsoft handed over some account data that
were stored in the U.S. but said it shouldn’t have to hand over the emails,
which were stored on a server in Ireland.
The companies say the case ultimately could threaten
American dominance in the $250 billion cloud-computing industry, because
foreign clients won’t use U.S. firms if their data aren’t protected.
The enactment of the Cloud legislation might leave little
for the Supreme Court to decide in the Microsoft case. When the court heard
oral arguments in February, multiple justices said congressional intervention
would be welcome.
"It would be good if Congress enacted legislation
that modernized this,” Justice Samuel Alito said.
Tech groups criticized the new measure’s implications for
privacy in several respects, casting it as a surrender of sorts in the wake of
the Microsoft case.
"The Cloud Act is a disappointing outcome after so
many human-rights groups weighed in on the Microsoft case at the U.S. Supreme
Court,” said Marc Rotenberg, president of the Electronic Privacy Information
Center.
EPIC and other groups had pushed for many updates to the
1980s-era privacy law, he said, “but they were ignored.” Greg Nojeim of the
Center for Democracy and Technology said the deal gives the Justice Department
too much leeway to open up U.S. data to authoritarian foreign governments.
“DOJ could use this legislation to diminish privacy
rights world-wide, or to persuade other governments to raise their surveillance
standards in order to qualify for an agreement,“ he said. ”We fear the U.S.
Congress hasn’t done enough to require DOJ to make the right decisions.”
“The internet industry applauds Congress for including
the Cloud Act in the omnibus spending bill,” said Melika Carroll, a senior vice
president for the Internet Association, a trade group representing big tech companies.
“It’s critical that we modernize U.S. privacy laws to reflect current realities
of how data is stored around the world. Passing the Cloud Act will enable law
enforcement to gather data stored abroad for the purposes of investigating
serious crimes, while still protecting individual privacy rights.”
—Brent Kendall contributed to this article.
Comments
Post a Comment