U.S. Congress Passes CLOUD Act - New Legislation Might Make Microsoft Supreme Court Case Moot

On March 23, 2018, the President of the United States, Donald Trump, signed an appropriations bill that included the CLOUD Act. The intended purpose of the CLOUD Act is to clarify how and when the United States and foreign countries can gain access to data stored in cloud servers in each other’s legal jurisdictions.

While this issue has been discussed in the past, the major impetus for this legislation is the pending Supreme Court decision in the Microsoft Cloud case. The case, based on the Stored Communications Act (SCA) of 1986, was difficult for the court to apply to the modern Internet. The intent of the CLOUD Act is to resolve the issue and render the court decision moot.

Primarily the CLOUD Act amends the SCA to allow United States authorities to compel U.S.-based service providers via warrant or subpoena to provide requested data stored on servers regardless of whether they are located within the U.S. or in foreign countries. Since other companies, for example Google, have faced similar issues, technology companies generally support the legislation. Privacy and human-rights activists have criticized the measure.

The CLOUD Act

The legislation creates a legal framework to resolve the increasingly frequent conflicts between the United States and foreign countries over access to data stored outside those countries. The basic legal question is that of extraterritorial jurisdiction, or the extent to which the legal system of one country can extend to another country. Examples of areas where these rights have been asserted include terrorism and piracy.

The act amended US law to make clear that law enforcement warrants can apply to data that United States based technology companies have stored anywhere in the world. It also gives those companies the right to challenge these warrants based on the privacy laws in the country where the data are stored.

In addition, the United States could enter into a bilateral agreement with a foreign nation to allow U.S. companies to respond to legal orders from foreign governments or courts. These agreements would be subject to executive branch certification, and subject to congressional review. Each certification would have to be renewed every five years.

The Microsoft Supreme Court Case

The new legislation might make the Microsoft Supreme Court case moot. During oral arguments multiple justices said that congressional action would be welcome. It is unclear if the law's application is retroactive. If it is not, the previous law would cover the Microsoft case, and the U.S. Justice Department would have to withdraw its warrant request to make the case moot.

Controversy over the Cloud Act

Technology companies generally seem to support the law because the Microsoft case could threaten the U.S. domination over the $250 billion cloud computing industry if foreign clients would not use U.S. companies. Brad Smith, Microsoft president and chief legal officer, said in a statement Wednesday the bill was "a strong statute and a good compromise," and added that "it gives tech companies like Microsoft the ability to stand up for the privacy rights of our customers around the world." Other companies, such as Google have faced similar issues.

"The internet industry applauds Congress for including the Cloud Act in the omnibus spending bill," said Melika Carroll, a senior vice president for the Internet Association, a trade group representing big technology companies. "It’s critical that we modernize U.S. privacy laws to reflect current realities of how data is stored around the world. Passing the Cloud Act will enable law enforcement to gather data stored abroad for the purposes of investigating serious crimes, while still protecting individual privacy rights."

Privacy and human rights activists feel differently.

"The Cloud Act is a disappointing outcome after so many human-rights groups weighed in on the Microsoft case at the U.S. Supreme Court," said Marc Rotenberg, president of the Electronic Privacy Information Center. Greg Nojeim of the Center for Democracy and Technology said the "DOJ could use this legislation to diminish privacy rights world-wide, or to persuade other governments to raise their surveillance standards in order to qualify for an agreement." He also said that "We fear the U.S. Congress hasn’t done enough to require DOJ to make the right decisions."

"We’re swapping out strong US protections for whatever protections the foreign governments have," said Gregory Nojeim, senior counsel at the Center for Democracy and Technology, a Washington, D.C. online privacy group.