Four Senate lawmakers have introduced a bill that would enable law enforcement officials to obtain people's emails, documents, photos and other digital data, regardless of where the data is physically stored.
The Clarifying Overseas Use of Data (CLOUD) Act, introduced this week by Senators Orrin Hatch (R-Utah), Chris Coons (D-Delaware), Lindsey Graham (R-South Carolina), and Sheldon Whitehouse (D-Rhode Island), provides that U.S. search warrants for data stored in the cloud are valid, even where the material is held in servers located outside the country.
Currently, it's not clear whether Microsoft, Google, Facebook and other tech companies must comply with search warrants for users' data that's stored overseas. The Supreme Court is slated to decide that question in a battle between Microsoft and the Department of Justice.
In that case, the 2nd Circuit Court of Appeals in New York ruled that Microsoft need not turn over a suspected drug seller's emails, which are physically stored in a data center in Ireland. Federal authorities are now asking the Supreme Court to reverse that decision and order Microsoft to turn over the material.
Digital rights groups like the Electronic Frontier Foundation are criticizing the proposed bill, arguing that it gives too much power to law enforcement, and sends the wrong message to other countries.
"The CLOUD Act would give unlimited jurisdiction to U.S. law enforcement over any data controlled by a service provider, regardless of where the data is stored and who created it," the EFF writes in a blog post. "The breadth of such unilateral extraterritorial access creates a dangerous precedent for other countries who may want to access information stored outside their own borders, including data stored in the United States."
The CLOUD Act also would allow foreign governments to enter into cross-border data agreements with the U.S. Those pacts could require U.S. companies to turn over users' emails and other data to foreign officials, even when they haven't obtained warrants or followed other procedures that are typically required in the U.S.
The digital rights group Center for Democracy & Technology, which has criticized the proposed bill, says it should be revised to "ensure that cross-border data demands by the U.S. and other governments conform to strong human rights standards."
The group adds: "Absent these improvements, the CLOUD Act will erode trust in the privacy of data stored in the cloud.”
But tech companies endorse the measure. Apple, Facebook, Google, Microsoft and Oath write in a letter to lawmakers that the proposed legislation would allow "law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts."