At the end of last month, the US government in a rush to avoid a government shutdown also approved the controversial CLOUD Act - Clarifying Lawful Overseas Use of Data Act. This legislation was added in the final pages of the Omnibus as an afterthought and never went through a review or received a hearing.
The legislation sorts the problem for governments when they need to get their hands on data stored outside of the country. One notable case that has potentially helped pave way for the CLOUD Act was Microsoft's fight with the US government over user emails stored in Ireland. The US government, making it a "poster child" case, chose to avoid going through the MLAT (mutual legal assistance treaties) process and pushed the company to cough up data.
Data will now be coughed up by Microsoft after the CLOUD Act
With the CLOUD Act now officially passed, Microsoft will be happy to deliver data since it had called the Act a "good compromise." Before the US government bundled the CLOUD Act with $1.3 trillion Omnibus Spending Bill in late March, Microsoft's Chief Legal Officer, Brad Smith, had said:
The proposed CLOUD Act creates a modern legal framework for how law enforcement agencies can access data across borders. It’s a strong statute and a good compromise that reflects recent bipartisan support in both chambers of Congress, as well as support from the Department of Justice, the White House, the National Association of Attorneys General and a broad cross section of technology companies.
With this hurdle out of the way, the US government has issued Microsoft with a fresh warrant to get access to emails stored in Ireland. The DoJ has also asked the Supreme Court to dismiss the existing legal battle that was started back in 2014.
Microsoft had argued that it cannot deliver internationally stored data on a domestic warrant. The United States Court of Appeals for the Second Circuit had also ruled in Microsoft's favour in 2016, but the DoJ appealed against it in the Supreme Court.
The DoJ has now filed a motion with the Supreme Court arguing that the court should vacate the judgement made by the Appeals Court and dismiss the case as moot following the passage of the CLOUD Act. "Microsoft no longer has any basis for suggesting that such a warrant is impermissibly extraterritorial because it reaches foreign-stored data, which was the sole contention in its motion to quash," the document reads (PDF). "There is thus no longer any live dispute between the parties, and the case is now moot."
The CLOUD act significantly expands law enforcement's access to data held overseas. It not only enables the United States government to seize data across the globe, but also allows foreign governments to do the same. Without any oversight, it will be interesting to see how tech companies protect their users under this new legislation while also helping global law enforcement agencies in their criminal investigations.
