Bonum Certa Men Certa

EPO and Microsoft Collude to Break the Law -- Part IV: The US CLOUD Act Passes Without Public Debate

Previous parts:



Cloudwashing law
Congress quietly slips cloud-spying powers into page 2,201 of emergency spending bill



Summary: "In 2013, the DoJ demanded that Microsoft grant it access to emails related to a narcotics case from a Hotmail account hosted in Ireland."

When Edward Snowden blew the whistle on the National Security Agency's PRISM program in 2013 and revealed what many had suspected – namely that US intelligence agencies were collecting vast amounts of data not only from US citizens, but from all around the world – public opinion received a badly needed wake-up call about the dangers of mass surveillance.



In the wake of these revelations, many countries became increasingly concerned about who could access their national information and the potential implications of cross-border data transfers. These concerns provided a catalyst for discussions focussing on the topic of what has come to be called "digital sovereignty" and/or "data sovereignty".

Another incident that put these topics into the spotlight was a dispute between Microsoft and the US Department of Justice (DoJ) which started in 2013.

"Despite having a major impact on how tech companies can be obliged to share user data with US and foreign governments, the CLOUD Act was passed by Congress without any public debate on 21 March 2018 and entered into force two days later."In 2013, the DoJ demanded that Microsoft grant it access to emails related to a narcotics case from a Hotmail account hosted in Ireland. Microsoft refused, arguing that a warrant issued under Section 2703 of the Stored Communications Act could not compel US companies to produce data stored in servers outside the US and that compliance with the requested transfer would result in the company breaking EU data protection law.

The initial ruling was in favour of the DoJ, with the presiding judge concluding that American companies “must turn over private information when served with a valid search warrant from US law enforcement agencies". Microsoft appealed to the US Second Circuit Court of Appeals which ruled in its favour in 2016 and invalidated the warrant. In response, the DoJ appealed to the US Supreme Court.

In March 2018, while the case was pending before the US Supreme Court, the US Congress passed the Clarifying Lawful Overseas Use of Data (CLOUD) Act which amended and extended the ECPA (Electronic Communications Privacy Act) and the SCA (Stored Communications Act).

"This highly controversial measure was buried on page 2,201 of a voluminous 2,232-page spending bill - the Consolidated Appropriations Act of 2018 - which was tabled and adopted as an emergency measure to prevent an impending government shutdown."Following agreement from both the DoJ and Microsoft, the US Supreme Court determined that the case had been rendered moot by the passage of the CLOUD Act and the issuing of a new warrant under the terms of the new legislation.

Despite having a major impact on how tech companies can be obliged to share user data with US and foreign governments, the CLOUD Act was passed by Congress without any public debate on 21 March 2018 and entered into force two days later.

This highly controversial measure was buried on page 2,201 of a voluminous 2,232-page spending bill - the Consolidated Appropriations Act of 2018 - which was tabled and adopted as an emergency measure to prevent an impending government shutdown.

Senators Rand Paul from Kentucky and Ron Wyden from Oregon raised procedural objections to the manner in which the CLOUD Act had been sneaked in as an appendage to the spending bill but ultimately they failed to block or stall the bill's adoption.

Ron Wyden on CLOUD Act
Ron Wyden complained about the CLOUD Act but failed to block its adoption



Privacy advocates at groups like the American Civil Liberties Union, the Center for Democracy and Technology and the Electronic Frontier Foundation criticized the legislation as “a new backdoor around the Fourth Amendment" which permitted the circumvention of constitutional protections against unreasonable searches by law enforcement agencies. They also argued that it could lead the US to send user data to police in countries known for abusing the human rights of their citizens.

"Privacy advocates at groups like the American Civil Liberties Union, the Center for Democracy and Technology and the Electronic Frontier Foundation criticized the legislation as “a new backdoor around the Fourth Amendment" which permitted the circumvention of constitutional protections against unreasonable searches by law enforcement agencies."On the other hand, US tech giants such as Microsoft, Google, Facebook, Apple, and Oath, applauded the legislation and sent a joint letter to the US Senate proclaiming that the CLOUD Act represented “notable progress to protect consumers’ rights".

The main effect of the CLOUD Act was to strengthen the powers of US law enforcement and intelligence agencies to access data held by US companies on foreign soil.

In a nutshell, the CLOUD Act amounted to a consolidation and expansion of the arrangements established by the earlier 2001 PATRIOT Act which had significantly extended the government's powers of access to data held by US-based global providers, irrespective of the storage location of that data.

This might help to explain why those pushing for the adoption of the measure preferred to avoid public debate by sneaking it in as a hidden appendage to an emergency spending bill.

On the other side of the Atlantic, the passage of the CLOUD Act gave a new impulse to the ongoing political debate about "digital sovereignty".

A year after the passage of the Act, an article in the French paper Les Echos reported that "[m]any observers feel that American justice could be deploying [the Cloud Act] for purposes of economic espionage.”

"In a nutshell, the CLOUD Act amounted to a consolidation and expansion of the arrangements established by the earlier 2001 PATRIOT Act which had significantly extended the government's powers of access to data held by US-based global providers, irrespective of the storage location of that data."The French politician Ms Laure de la Raudiere who co-chairs a parliamentary cyber-security and sovereignty committee described the CLOUD Act as "a wakeup call for Europe to accelerate its own sovereign capabilities in the data sector".

In response to the concerns articulated by various political and business leaders, the French government called upon French companies to rely on "CLOUD-Act-safe" data providers.

In the meantime, on 25 May 2018, a few months after the adoption of the CLOUD Act by the US Congress, the General Data Protection Regulation (GDPR) entered into effect. In the next part of this series we will look at the GDPR and its implications for transatlantic data traffic between the EU and the US.

Recent Techrights' Posts

The "Luddite" Complex
Sometimes simplest is best and sometimes "modern" is designed not with the buyers' interest in mind
SCO's Darl McBride Dead at Age 64
There's hardly any information about it, except we know he reached bankruptcy and 3 years later he died at a relatively young age
[Meme] Python Knows Its Bosses
Microsoft strings attached
[Meme] Debt of About $20 Per Active User
Facebook isn't laying off tens of thousands for "efficiency" but for survival
 
GNU/Linux Usage Surveys: Up to 6.8% (With ChromeOS, Based on StatCounter) in Desktops/Laptops and Above 2% in Steam
Today StatCounter starts releasing graphs based on data for November
Gemini Links 02/11/2024: Petscop, Jokes, and RetroChallenge
Links for the day
Links 02/11/2024: Temu EU Probe and Shorts Trademark
Links for the day
The 'Turning-Free-Code-Proprietary Foundation' (Linux/Microsoft Foundation)
LF will basically become just as sinister as its corporate sponsors
Python Software Foundation is 'Cancel Culture' Rehomed
Python isn't grassroots and it doesn't really tolerate grassroots
DeVault "Closes Down His Mailing Lists Every Time There's a Scandal" and Also Censors Messages
Censorious code hosting platform
What Social Control Media Really Is
Social Control Media, in a nutshell, isn't just bad if its controller is some foreign or hostile nation
Taking Ethics Lectures From Drew
Projection tactics
Links 02/11/2024: Facebook Stock Falls (Soaring Debt), Apple’s Quarterly Profit Down
Links for the day
Gemini Links 02/11/2024: Burnout, Emacs Bookmarks, and Smooth Migration
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, November 01, 2024
IRC logs for Friday, November 01, 2024
Facebook's Debt Has Soared to All-Time High of Nearly 50 Billion Dollars
But the corporate media pretends all is well (while mass layoffs continue and slop takes over the social control media)
Geminispace Makes It Past 4,200 Capsules on November 1st
At last!
Links 01/11/2024: Election Interferences by X/Twitter/Musk, Strava as Espionage Tool
Links for the day
The October 2024 Web Server Survey Shows a Further Collapse for Microsoft in the Servers Market
Microsoft experienced the next largest loss of 699,464 sites (-3.45%)
Gemini Links 01/11/2024: TLS Sucks, twytere.com Announced
Links for the day
Links 01/11/2024: Few Things Are Cheaper Than This Antenna and "Nothing Lasts Forever"
Links for the day
Technology: rights or responsibilities? - Part V
By Dr. Andy Farnell
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, October 31, 2024
IRC logs for Thursday, October 31, 2024
R.T.O. is Another Name (or Acronym) for Voluntary Layoffs
Amazon is trying to get many workers to leave on their own
Microsoft's Acquisition of Activision (to Fake Revenue Growth by Buying Revenue) Was a Failure
Of course the mass layoffs at Microsoft aren't just a Microsoft thing
Stagnant, Shrinking Businesses and "IBM's Corporate Culture Since the Late 1980s... Over 35 Years."
Recently, IBM was using share price as a talking point, insisting the company was doing OK while tens of thousands were being laid off
Links 01/11/2024: World News, Political Catchup
Links for the day
[Meme] Probably the Worst Possible Time to Get Information From Social Control Media
Musk does not want to prevent disinformation from spreading and the same is true for Facebook and TikTok; they have their own interests
Update on Litigation Against the European Patent Office (EPO) at the ILO Administrative Tribunal (ILOAT)
Rewards and compensation for staff have long fallen, resulting in many experienced colleagues leaving and causing further declines in quality and compliance
Gemini Links 31/10/2024: NNCP, Declutter the Web, Cost of Community
Links for the day
Links 31/10/2024: Supermicro Plummets 33%, Block and Dropbox Mass Layoffs
Links for the day
Links 31/10/2024: Environmental Anxiety, Profound Changes in Hardware Market
Links for the day
Links 30/10/2024: TSMC Concerns and North Koreans in Ukraine War
Links for the day
Facebook is for Zombies
Social control media is for fools
Microsoft Now Has $235,290,000,000 in Liabilities, They Grow Over Time in Spite of Mass Layoffs (So Expect More Layoffs)
expect more mass layoffs
Links 31/10/2024: DST Woes, War Updates, Amazon RTO Backlash
Links for the day
Gemini Links 31/10/2024: Attention Economy and Gemlogs
Links for the day
Happy Halloween
October is nearly over
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, October 30, 2024
IRC logs for Wednesday, October 30, 2024
For the Record: Linux is Controlled by the United States of America
"This is going to make many question the openness and inclusivity of the work done by Linux Foundation"
Microsoft: XBox Hardware Revenues Down About 30% (Ignore the Buzzwords and Activision Activity Dressed Up as "XBox")
For context, in a previous quarter XBox hardware sales were down by about 50%
Cooking the Books With "Cloud" And "AI" Was Not Enough to Fool Microsoft Investors
"Microsoft Shares Drop on Disappointing Azure Growth Forecast"