Four Senate lawmakers have introduced a bill that would
enable law enforcement officials to obtain people's emails, documents, photos and other digital data, regardless of where the data is physically stored.
The Clarifying Overseas Use of Data (CLOUD) Act, introduced this week by Senators Orrin Hatch (R-Utah), Chris Coons
(D-Delaware), Lindsey Graham (R-South Carolina), and Sheldon Whitehouse (D-Rhode Island), provides that U.S. search warrants for data stored in the cloud are valid, even where the material is held in
servers located outside the country.
Currently, it's not clear whether Microsoft, Google, Facebook and other tech companies must comply with search warrants for users' data that's stored
overseas. The Supreme Court is slated to decide that question in a battle between Microsoft and the Department of Justice.
In that case, the 2nd Circuit Court of Appeals in New York ruled that
Microsoft need not turn over a suspected drug seller's emails, which are physically stored in a data center in Ireland. Federal authorities are now asking the Supreme Court to reverse that decision
and order Microsoft to turn over the material.
Digital rights groups like the Electronic Frontier Foundation are criticizing the proposed bill, arguing that it gives too much power to law
enforcement, and sends the wrong message to other countries.
"The CLOUD Act would give unlimited jurisdiction to U.S. law enforcement over any data controlled by a service provider, regardless
of where the data is stored and who created it," the EFF writes in a blog post. "The
breadth of such unilateral extraterritorial access creates a dangerous precedent for other countries who may want to access information stored outside their own borders, including data stored in the
United States."
The CLOUD Act also would allow foreign governments to enter into cross-border data agreements with the U.S. Those pacts could require U.S. companies to turn over users' emails
and other data to foreign officials, even when they haven't obtained warrants or followed other procedures that are typically required in the U.S.
The digital rights group Center for Democracy
& Technology, which has criticized the proposed bill, says it should be revised to "ensure
that cross-border data demands by the U.S. and other governments conform to strong human rights standards."
The group adds: "Absent these improvements, the CLOUD Act will erode trust in the
privacy of data stored in the cloud.”
But tech companies endorse the measure. Apple, Facebook, Google, Microsoft and Oath write in a letter to lawmakers that the proposed
legislation would allow "law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts."