by Steve Horn

Civil liberties advocates have decried a provision tucked into the budget bill recently passed by Congress and signed into law by President Donald Trump, as an end-run around constitutional protections guaranteed under the Fourth Amendment to the U.S. Constitution.

That provision was originally the stand-alone CLOUD (Clarifying Lawful Overseas Use of Data) Act (H.R.4943 and S. 2383) bill and is buried on page 2,212 of the 2,232-page budget bill. It permits information to be collected from cloud computing companies by foreign governments on U.S. citizens living abroad to be fed to the U.S. Department of Justice and other federal investigatory agencies as part of criminal investigations, even if obtained without a search warrant. Generally, the Fourth Amendment requires that both probable cause and a search warrant be obtained by law enforcement before the search and seizure of “persons, houses, papers, and effects.”

Specifically, the CLOUD Act states that it “shall not be unlawful … for a provider of electronic communication service to the public or remote computing service to intercept or disclose the contents of a wire or electronic communication in response to an order from a foreign government that is subject to an executive agreement that the Attorney General has determined.”

U.S. Sen. Rand Paul, R-Ky., often an outspoken voice on constitutional issues from a libertarian point of view, decried his congressional colleagues burying the provision in the omnibus spending bill.

“Congress can’t vote to reject the CLOUD Act, because it just got stuck onto the Omnibus, with no prior legislative action or review,” he stated on Twitter.

Paul’s Senate colleague on the Democratic Party side of the aisle, U.S. Sen. Ron Wyden, D-Ore., also spoke to his long-term concerns about attaching the provision to the budget bill on Twitter.

“The CLOUD Act will give Trump — or any president — far too much power to approve surveillance agreements with human rights abusing foreign governments without real oversight by Congress,” tweeted Wyden.

Pending a successful legal challenge, though, the bill now sits as the law of the land. And it has been advocated and lobbied for by a large swath of both the tech and telecommunications sectors.

Follow the Money: NSA, Utah Ties

The CLOUD Act was originally introduced on February 26 by U.S. Sen. Orrin Hatch, R-Utah, who represents a state in which the U.S. National Security Agency (“NSA”) opened its $1.5 billion largest-yet data storage facility in Bluffdale, Utah, in 2014, known as the Mission Data Repository.

During his 2012 U.S. Senate re-election campaign, Hatch received $3,000 in campaign contributions from AT&T and $7,000 from Verizon, as well as $10,000 from Hewlett-Packard and Intel and $2,500 from Microsoft.

CLOUD Act co-sponsor U.S. Sen. Chris Coons, D-Del., also has received tens of thousands of dollars in campaign contributions during his 2014 re-election campaign from the tech and telecommunications industries. That included $10,000 from Microsoft and $7,500 from Hewlett-Packard, as well as donations from Amazon, Facebook and Google, Comcast, Sprint and others.

Another bill co-sponsor, U.S. Rep. Doug Collins (R-GA), also has enjoyed campaign contributions from the tech industry for his ongoing 2018 midterm elections race. That includes $2,500 from Dell, $5,000 from Intel, $2,500 from Oracle, $3,000 from AT&T and $8,500 from Comcast.

Many of those same tech and telecommunications companies have a data-sharing agreement with the NSA through its PRISM program, whose existence was revealed in 2013 via NSA whistleblower Edward Snowden and journalist Glenn Greenwald, then working for the publication The Guardian. As part of that same 2013 reporting batch, Greenwald also revealed that the NSA collects phone records of millions of Verizon customers on a daily basis with the company compelled to do so under a Foreign Intelligence Surveillance Court order.

“The CLOUD Act bridges the divide that sometimes exists between law enforcement and the tech sector by giving law enforcement the tools it needs to access data throughout the world while at the same time creating a commonsense framework to encourage international cooperation to resolve conflicts of law,” Hatch said in a February press statement in introducing the bill, pointing to the then-looming oral arguments about to transpire in the United States v. Microsoft case.

Utah’s Republican Attorney General, Sean Reyes, also came out in support of the bill, as did a bipartisan cadre of 36 state-level attorneys general representing the National Association of Attorneys General.

Hatch previously served as the lead sponsor of the International Communications Privacy Act, a 2017 bill with the same language as the CLOUD Act (S.1671/H.R. 3718). According to federal lobbying disclosure forms reviewed by Criminal Legal News, companies such as Microsoft, Facebook, AT&T, Yahoo!, Cisco, Oracle, Verizon, Intel, Amazon Hewlett Packard, and others all advocated for that bill’s passage and that of the same bill introduced the year earlier in 2016 bearing the same name (S.2986/H.R. 5323).

SCOTUS End-Around

On February 27, the day after Hatch introduced the CLOUD Act, the U.S. Supreme Court heard oral arguments in the case United States v. Microsoft, which grappled with the same issues at play in the CLOUD Act. That is, whether Microsoft had to hand over data to a U.S. Magistrate Judge in an international drug trafficking case, in which the data was stored in Ireland. But with the passage of the CLOUD Act, that case’s ultimate decision – if that happens at all – may be a moot point now that Congress has passed a new law on the matter.

On January 18, just weeks before the introduction of the CLOUD Act, Hatch co-wrote an amicus curiae brief to the Court with a bipartisan group of congressmen – some of them also co-sponsors of the CLOUD Act – in what was, in essence, a preview of the looming introduction of legislation.

“[T]here is growing bipartisan support within Congress for enacting a comprehensive framework to govern the circumstances in which a warrant may be utilized to secure access to data stored overseas,” the congressmen wrote in their brief. “Whether and to what extent such a procedure should be authorized is a prerogative reserved to Congress.”

Big Tech’s Vocal Support

Though Microsoft is a defendant in the ongoing Supreme Court case and was seemingly opposed to data collection measures of the sort dictated by the CLOUD Act given to its involvement in that lawsuit, the company has now come out in support of the bill’s inclusion and passage as part of the budget bill.

The bill “creates a modern legal framework for how law enforcement agencies can access data,” wrote Brad Smith, president of Microsoft, in a blog post published by the company. “And it gives companies like Microsoft the ability to stand up for the privacy rights of our customers around the world.”

Companies such as Apple, Facebook, and Google also joined Microsoft in an earlier letter, published on February 6, in support of the legislation, as well. They called it “an important step toward enhancing and protecting individual privacy rights.”

In the aftermath of the CLOUD Act’s passage, the U.S. Department of Justice filed a Motion to Vacate the case with the Supreme Court, with Microsoft responding in turn on April 3 that it agrees with the motion, as the CLOUD Act has made the case moot. Microsoft also said in its legal motion, filed with the Court on April 3, that a U.S. government law enforcement agency has filed a new search warrant.

“Microsoft will, in the ordinary course, evaluate the new warrant as it evaluates all warrants that law-enforcement entities serve on it,” said of that new warrant filed under the new legal authority of the CLOUD Act.

Microsoft and its lawyers did not respond to a Criminal Legal News request for comment by press time about its stance on this issue, concerns raised by critics, and its apparent about-face. But a company spokesman pointed to an April 3 blog post, written by Microsoft President Brad Smith, in which Smith gave a long response about the company’s stance on the legislation.

“We did not sue our own government four times and devote energy to these issues over four sometimes long years to stop showing resolve now,” wrote Smith. “Law enforcement needs to be effective and privacy rights need to be protected. This journey is not yet complete, and we look forward to continuing to work with so many others to see it to a successful conclusion.”

‘Few Mechanics to Prevent Abuse’

Those concerned about human rights, civil liberties and criminal procedural issues, though, don’t agree with Smith or tech and telecommunications companies on their stance on the CLOUD Act. On March 12, two dozen groups, such as the American Civil Liberties Union, Human Rights Watch, Electronic Frontier Foundation, National Association of Criminal Defense Lawyers, National Black Justice Coalition and others, wrote a letter in opposition to the bill, which laid out their myriad concerns about it.

“We believe the CLOUD Act undermines privacy and other human rights, as well as important democratic safeguards,” they wrote, also arguing that “the bill fails to protect the rights of Americans and individuals abroad, and would place too much authority in the hands of the executive branch with few mechanisms to prevent abuse.” The groups further argue that the bill violates basic tenets of the Fourth Amendment.

Though the groups have yet to announce their next moves on what to do about the CLOUD Act, it is likely we will see the legislation litigated both in federal courts and in public discourse by them and others in the weeks, months, and years ahead. 

Sources: http://docs.house.gov/billsthisweek/​20180319/BILLS-115SAHR1625-RCP115-​66.pdf, https://www.congress.gov/115/bills/hr4943/BILLS-115hr4943ih.pdf, https://www.congress.gov/115/bills/s2383/BILLS-115s2383is.pdf, https://twitter.com/RandPaul/status/976654222879019008, https://twitter.com/ronwyden/status/973319494381776896; https://www.opensecrets.org, https://www.theguardian.com, https://www.aclu.org/sites/default/files/field_document/cloud_act_coalition_letter_3-8_clean.pdf, https://blogs.microsoft.com/on-the-issues/2018/03/21/microsoft-statement-on-the-inclusion-of-the-cloud-act-in-the-omnibus-funding-bill; https://blogs.microsoft.com/datalaw/wp-content/uploads/sites/149/2018/02/Tech-Companies-Letter-of-Support-for-Senate-CLOUD-Act-020618.pdf, https://www.congress.gov/114/bills/hr5323/BILLS-114hr5323ih.pdf, https://www.congress.gov/114/bills/s2986/BILLS-114s2986is.pdf, https://www.congress.gov/115/bills/hr3718/BILLS-115hr3718ih.pdf, https://www.congress.gov/115/bills/s1671/BILLS-115s1671is.pdf, https://attorneygeneral.utah.gov/wp-content/uploads/2018/02/Final-2.21-CLOUD-Act-Letter.pdf, https://www.hatch.senate.gov/public/index.cfm/2018/2/the-​cloud-​act-it-s-time-for-our-laws-to-catch-up-with-our-technology; https://www.supremecourt.gov/DocketPDF/17/17-2/42149/20180403145952967_​180401%20for%20E-Filing.pdf; https://blogs.microsoft.com/on-the-issues/2018/04/03/the-cloud-act-is-an-important-step-forward-but-now-more-steps-need-to-follow/?ranMID=24542&ranEAID=je6NUbpObpQ&ranSiteID=je6NUbpObpQ-zDpX8OKUMQdq.72TqY12DA&tduid=(02233d9855c5589c5eab7198b81d0a3f)(256380)(2459594)(je6NUbpObpQ-zDpX8OKUMQdq.72TqY12DA)(); https://www.supremecourt.gov/DocketPDF/17/17-2/41851/20180330172237829_17-2motUnitedStates.pdf

Subscribe today

Already a subscriber? Login