Legislators stuffed the CLOUD Act—short for the Clarifying Lawful Overseas Use of Data Act—into the 2,232-page omnibus spending bill that’s headed to President Donald Trump’s desk for his signature—or veto, as he threatened this morning. If signed into law, the act would rewrite the rules for how U.S. tech companies deal with law-enforcement requests for data across international borders.
The new legislation’s most immediate impact would be felt in the Supreme Court, where the justices are currently mulling United States v. Microsoft. The tech giant is contesting a warrant issued by federal prosecutors, under the Stored Communications Act of 1986, for data stored on servers at a Microsoft data center in Ireland. Microsoft argues that Congress didn’t intend for the 1986 law to apply to data held by U.S. companies overseas.
During oral arguments last month, some of the justices asked lawyers from both sides whether the court should simply wait for Congress to pass the CLOUD Act. The new law would resolve the extraterritoriality question in the government’s favor, likely rendering the Supreme Court case moot. Microsoft also backed the CLOUD Act because it clarifies how previous legal standards for computer searches apply to newer technologies. Because the 1986 law predates cloud computing or mass adoption of the internet, I noted last month that the justices’ task was essentially to “interpret a Bronze Age law for an Iron Age world.”
While the CLOUD Act’s passage would satisfy both Microsoft and federal prosecutors, digital-privacy groups are far less thrilled. The new law also streamlines how foreign governments obtain data stored on U.S.-based servers, a move that’s raised concerns about lowered privacy standards for citizens and non-citizens inside the United States. Congress’s hasty incorporation of the CLOUD Act into a massive spending bill also drew criticism for short-circuiting a major policy debate. “Because of this failure, U.S. and foreign police will have new mechanisms to seize data across the globe,” the Electronic Frontier Foundation warned on Thursday night.