Congress gives police in other countries easier access to U.S. data, raising privacy concerns

Erin Kelly | USA TODAY

WASHINGTON – Police in other countries will be able to get emails and other electronic communication more easily from their own citizens and from Americans under a bill that Congress stuffed inside the massive $1.3 trillion spending deal passed last week.

Supporters said the bill, dubbed the CLOUD Act, will simplify the process for the U.S. government and its allies to get evidence of serious crimes and terrorist threats when that evidence is stored on a server in another country.

Internet providers had been able to legally stop police agencies from gaining access to their own citizens' emails if those emails were stored in a foreign nation. Microsoft stores data on about 1 million servers in 40 countries.

"The CLOUD Act can save lives, preserve international relations, empower law enforcement and ensure justice for citizens," said James Scott, senior fellow at the Institute for Critical Infrastructure Technology.

Opponents, including civil liberty and privacy rights groups, said the law could make it easier for nations with human rights abuses to spy on dissidents and collect data on Americans who communicate with foreign nationals.

"Tucked away in the omnibus spending bill is a provision that allows Trump, and any future president, to share Americans' private emails and other information with countries he personally likes," said Sen. Ron Wyden, D-Ore. "That means he can strike deals with Russia or Turkey with nearly zero congressional involvement and no oversight by U.S. courts."

More: Massive spending bill spans thousands of pages, with programs that touch nearly every American

More: What's in — and what's out — of the $1.3 trillion spending bill

More: Senate passes sweeping $1.3 trillion spending bill, sending it to Trump's desk

In a letter to Congress, the American Civil Liberties Union, the Electronic Frontier Foundation, Human Rights Watch and other civil liberties groups said the CLOUD Act allows foreign governments to wiretap on American soil, using standards that don't comply with U.S. law, and gives the executive branch the power to enter into agreements with other nations without congressional approval.

The 24 groups said the law permits foreign police agencies to get information about people in the USA without having to follow the search-and-seizure rules imposed by the U.S. Constitution, and it could give foreign governments access to information they could use to torture their critics.

"We believe the CLOUD Act undermines privacy and other human rights, as well as important democratic safeguards," the letter says.

The bill won the support of Microsoft and other tech giants, who said it will clarify how Internet providers are supposed to respond when law enforcement agencies seek data across borders.

Microsoft President and Chief Legal Officer Brad Smith said in a blog post Wednesday that congressional passage of the CLOUD Act "is a critical step forward in resolving an issue that has been the subject of litigation for over four years."

"It’s a strong statute and a good compromise that reflects recent bipartisan support in both chambers of Congress, as well as support from the Department of Justice, the White House, the National Association of Attorneys General and a broad cross section of technology companies," Smith wrote. "It also responds directly to the needs of foreign governments frustrated about their inability to investigate crimes in their own countries."

At the same time, Smith wrote, the law prevents governments from requiring U.S. companies to create "backdoors" around encrypted data, helping to protect users' privacy.

"It gives tech companies like Microsoft the ability to stand up for the privacy rights of our customers around the world," he wrote.

The CLOUD Act is an attempt to update a 32-year-old law that was passed before the World Wide Web existed. That obsolete law, the Stored Communications Act, is the subject of a case before the U.S. Supreme Court — a case that is moot because of Congress' approval of the new law.

The case, which pitted the federal government against Microsoft, centered on an attempt by U.S. law enforcement to obtain emails in a drug-trafficking case that were stored on a Microsoft server in Dublin.

Microsoft argued that it shouldn't have to turn over its users' emails because they were outside the USA and beyond the reach of law.

The justices made clear during oral arguments last month that they hoped Congress would resolve the issue for them by passing a law to deal with modern technology.

Congress obliged by passing a law without any committee votes or debate on the issue in either the House or Senate.

"Congress should reject the CLOUD Act because it fails to protect human rights or Americans’ privacy...gives up their constitutional role, and gives far too much power to the attorney general, the secretary of state, the president and foreign governments," Sen. Rand Paul, R-Ky., said Thursday on Twitter. "But guess what? Congress can't vote to reject the CLOUD Act, because it just got stuck onto the Omnibus (spending bill), with no prior legislative action or review."

But guess what? Congress can’t vote to reject the CLOUD Act, because it just got stuck onto the Omnibus, with no prior legislative action or review. https://t.co/8b6W08goXm — Senator Rand Paul (@RandPaul) March 22, 2018











